CODEWITHSUNDEEP
assemblyx86reverse-engineeringanalysismalware
Ahmed Mohammed
Ahmed Mohammed

Reputation: 15

How stosd works in assembly?

Sorry for this question .. just wanted to understand how stosd works in assembly when EAX is zero

mov ecx, 41
lea edi, [variable]
xor eax, eax
rep stosd

I was debugging a malware with these instructions and with each stosd i can see windows directories paths are coming when following edi in dump.

But from where these directories are comming when EAX is zero and not referring to any variable?

Upvotes: 0

Views: 704

Answers (1)

Margaret Bloom
Margaret Bloom

Reputation: 44106

You are seeing the pointers already stored in the array pointed by edi, before each stosd overwrites them with zero.

stosd writes eax to edi and increments it by four (assuming the DF flag is not set, which is usually the case).

That snippet is equivalent to memset(variable, 0, 41*4).

Upvotes: 3

Related Questions