FindChar function to find characters inside strings :
.386
.model flat,stdcall
option casemap:none
ExitProcess PROTO :DWORD
printf PROTO C :DWORD,:VARARG
.data
mystr db 'This is a test.',0
f1 db 'Address of the string = %X',13,10
db 'Address of the character a = %X',0
.code
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE
FindChar PROC src:DWORD,char:DWORD
mov eax,DWORD PTR [esp+4]
mov ecx,DWORD PTR [esp+8]
dec eax
@@:
inc eax
mov dl,BYTE PTR [eax]
test dl,dl
setz dh
xor dl,cl
setz ch
or ch,dh
jz @b
retn 8
FindChar ENDP
OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef
start:
invoke FindChar,ADDR mystr,'a'
invoke printf,ADDR f1,ADDR mystr,eax
invoke ExitProcess,0
END start
Here is the 64-bit version :
ExitProcess PROTO :QWORD
printf PROTO :QWORD,:VARARG
.data
mystr db 'This is a test.',0
f1 db 'Address of the string = %X',13,10
db 'Address of the character a = %X',0
.code
FindChar PROC src:QWORD,char:QWORD
mov rax,rcx
dec rax
@@:
inc rax
mov r8b,BYTE PTR [rax]
test r8b,r8b
setz cl
xor r8b,dl
setz ch
or cl,ch
jz @b
ret
FindChar ENDP
start PROC PARMAREA=4*SIZEOF(QWORD)
invoke FindChar,ADDR mystr,'a'
invoke printf,ADDR f1,ADDR mystr,rax
invoke ExitProcess,0
start ENDP
END start
👍
Another version assuming that the string to be searched contains only printable characters :
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE
FindChar PROC src:DWORD,char:DWORD
mov eax,DWORD PTR [esp+4]
mov ecx,DWORD PTR [esp+8]
dec eax
@@:
inc eax
mov dl,BYTE PTR [eax]
mov dh,dl
xor dl,cl
sub dx,0101h
or dl,dh
cmp dl,255
jnz @b
retn 8
FindChar ENDP
OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef
Function determining the extension of a file. FindExt is based on FindChar.
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE
FindExt PROC src:DWORD
mov eax,DWORD PTR [esp+4]
dec eax
mov cl,'.'
@@:
inc eax
mov dl,BYTE PTR [eax]
test dl,dl
setz dh
xor dl,cl
setz ch
or ch,dh
jz @b
retn 4
FindExt ENDP
OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef
An interesting code.
Erol, can you add a comments to that code too, so it explain register usage for bytes better.
PathFindExtension :
https://learn.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-pathfindextensiona
PathCchFindExtension :
https://learn.microsoft.com/en-us/windows/win32/api/pathcch/nf-pathcch-pathcchfindextension
Hi Timo,
Sorry for the late reply. I modified my posts above to present a better algo. Here are the comments :
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE
FindChar PROC src:DWORD,char:DWORD
eax to point the string to search for a specific character :
mov eax,DWORD PTR [esp+4]
ecx holding the character to be found :
mov ecx,DWORD PTR [esp+8]
Decrement eax so modifying eax should not interfer with the only jmp jz
dec eax
@@:
inc eax
Get a byte from eax pointing the string
mov dl,BYTE PTR [eax]
Check if it's NULL terminator
test dl,dl
If dl is NULL set dh to 1
setz dh
If ( dl XOR cl ) == 0 the we found the char we were looking for.
dl XOR cl is zero if dl == cl :
xor dl,cl
setz ch
If none of the conditions above are met then return back to the top of the loop :
or ch,dh
jz @b
retn 8
FindChar ENDP
OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef