rep stos dword ptr es:[edi] 是做什么的?

怼烎@ 2022-04-05 11:49 164阅读 0赞

转自：[https://blog.csdn.net/nicholas199109/article/details/8560988][https_blog.csdn.net_nicholas199109_article_details_8560988]

笔者在winDBG中反汇编一个小程序的main函数, 看到了如下的一段代码:

> 0:000> uf .  
> monitor!main \[c:\\users\\myalias\\documents\\visual studio 2005\\projects\\mytest\\mytest\\main.c @ 32\]:  
> 32 0042f780 55 push ebp  
> 32 0042f781 8bec mov ebp,esp  
> 32 0042f783 81eccc000000 sub esp,0CCh  
> 32 0042f789 53 push ebx  
> 32 0042f78a 56 push esi  
> 32 0042f78b 57 push edi  
> 32 0042f78c 8dbd34ffffff lea edi,\[ebp-0CCh\]  
> 32 0042f792 b933000000 mov ecx,33h  
> 32 0042f797 b8cccccccc mov eax,0CCCCCCCCh  
> 32 0042f79c f3ab rep stos dword ptr es:\[edi\]

有点不明白高亮语句的作用, 在stackoverflow的一篇帖子中找到了答案.

> ; This puts the address of the stack frame bottom (lowest address) into edi...  
> lea edi,\[ebp-0C0h\]  
> ; ...and then fill the stack frame with the uninitialised data value (ecx = number of  
> ; dwords, eax = value to store)  
> mov ecx,30h  
> mov eax,0CCCCCCCCh  
> rep stos dword ptr es:\[edi\]

即, rep指令的目的是重复其上面的指令. ECX的值是重复的次数.

所以, 我列出的代码的作用是将栈上从ebp-0xcc开始的位置向高地址方向的内存赋值0xCCCCCCCC,次数重复0x33(51)次. 注意0xCCCCCCCC代表着未被初始化.

把STOS和REP的功能弄清楚, 上面的答案就不难理解了.

=================

STOS指令的作用是将eax中的值拷贝到ES:EDI指向的地址. 如果设置了direction flag, 那么edi会在该指令执行后减小, 如果没有设置direction flag, 那么edi的值会增加, 这是为了下一次的存储做准备.

REP可以是任何字符传指令(CMPS, LODS, MOVS, SCAS, STOS)的前缀. REP能够引发其后的字符串指令被重复, 只要ecx的值不为0, 重复就会继续. 每一次字符串指令执行后, ecx的值都会减小.

参考资料

===================

Can anyone help me interpret this simple disassembly from WinDbg?

[http://stackoverflow.com/questions/4024492/can-anyone-help-me-interpret-this-simple-disassembly-from-windbg][http_stackoverflow.com_questions_4024492_can-anyone-help-me-interpret-this-simple-disassembly-from-windbg]

STOS

[http://www.cs.ubbcluj.ro/~dadi/ac/doc/ng1cf0a.html][http_www.cs.ubbcluj.ro_dadi_ac_doc_ng1cf0a.html]

REP

[http://www.cs.ubbcluj.ro/~dadi/ac/doc/ng15a5f.html][http_www.cs.ubbcluj.ro_dadi_ac_doc_ng15a5f.html]

[https_blog.csdn.net_nicholas199109_article_details_8560988]: https://blog.csdn.net/nicholas199109/article/details/8560988
[http_stackoverflow.com_questions_4024492_can-anyone-help-me-interpret-this-simple-disassembly-from-windbg]: http://stackoverflow.com/questions/4024492/can-anyone-help-me-interpret-this-simple-disassembly-from-windbg
[http_www.cs.ubbcluj.ro_dadi_ac_doc_ng1cf0a.html]: http://www.cs.ubbcluj.ro/~dadi/ac/doc/ng1cf0a.html
[http_www.cs.ubbcluj.ro_dadi_ac_doc_ng15a5f.html]: http://www.cs.ubbcluj.ro/~dadi/ac/doc/ng15a5f.html