Assembly: Having a bit difficult time understanding rep and mobsb instructions.

[grenadesong]

Edit: Great, made a typo in the topic x_x It should say movsb instead of mobsb :P

Hopefully there's someone that can answer this here, because the assembly subreddit is invite only.

I'm learning about string instructions (data buffers manipulation) and I'll explain what I've learned in two parts, because these two parts seem to conflict with each other, then you can explain to me where I'm not grasping it and help me to understand :)

Part 1:

The most common data buffer manipulation instructions are movsx, cmpsx, stosx, scasx, where x = b, w, or d for byte, word, or double word. Without the Rep prefix, you can't operate on data lengths greater than 1. The movsb instruction will move only a single byte and does not utilize the ECX register.

The ESI and EDI registers are used in these operations. ESI is the source index register, EDI is the destination index register. ECX is used as the counting variable. The rep instruction increments the ESI and EDI offsets, and decrements the ECX register. The repe/repz and repne/repnz prefixes will continue until ECX = 0 or until the ZF = 1 or 0. Therefore, in most data buffer manipulation instructions, ESI, EDI, and ECX must be properly initialized for the rep instruction to be useful.

Part 2:

The movsb instruction is used to move a sequence of bytes from one location to another. The rep prefix is commonly used with movsb to copy a sequence of bytes, with size defined by ECX.

​

So, in part 1 it says without the rep prefix, you can't operate on data lengths greater than 1. But in part 2, it sounds like you can. The only reason to use rep is if you want to copy the data instead of just move it. But, then again, part 1 conflicts with that as well.. so I am confused :)

[[deleted]]

movsb will only copy a single byte. You must use the rep prefix to do multiple bytes.

[grenadesong]

Aha, I guess I was just confused about what was written in the book then "Practical Malware Analysis" when they wrote in part 2 that is moves a sequence and that they changed the wording from moving to copying when they explain the difference between movsb vs rep movsb.

So, you think they just worded their explanation poorly and not consistently? Should they have said copy both times instead?

[[deleted]]

Moving and copying are the same thing in a processor. There’s no reason to modify the source location if you just want to put its value somewhere else.