Find characters inside a string

[Vortex]

FindChar function to find characters inside strings :

Code Select Expand

.386
.model flat,stdcall
option casemap:none

ExitProcess PROTO :DWORD
printf PROTO C :DWORD,:VARARG

.data

mystr   db 'This is a test.',0
f1      db 'Address of the string = %X',13,10
        db 'Address of the character a = %X',0

.code

OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE

FindChar PROC src:DWORD,char:DWORD

    mov     eax,DWORD PTR [esp+4]
    mov     ecx,DWORD PTR [esp+8]
    dec     eax
@@:
    inc     eax
    mov     dl,BYTE PTR [eax]
    test    dl,dl
    setz    dh
    xor     dl,cl
    setz    ch
    or      ch,dh
    jz      @b
    retn    8

FindChar ENDP

OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef

start:

    invoke  FindChar,ADDR mystr,'a'
    invoke  printf,ADDR f1,ADDR mystr,eax

    invoke  ExitProcess,0

END start


[Vortex]

Here is the 64-bit version :

Code Select Expand

ExitProcess PROTO :QWORD
printf PROTO :QWORD,:VARARG

.data

mystr   db 'This is a test.',0
f1      db 'Address of the string = %X',13,10
        db 'Address of the character a = %X',0

.code

FindChar PROC src:QWORD,char:QWORD

    mov     rax,rcx
    dec     rax
@@:
    inc     rax
    mov     r8b,BYTE PTR [rax]
    test    r8b,r8b
    setz    cl
    xor     r8b,dl
    setz    ch
    or      cl,ch
    jz      @b
    ret

FindChar ENDP

start PROC PARMAREA=4*SIZEOF(QWORD)

    invoke  FindChar,ADDR mystr,'a'
    invoke  printf,ADDR f1,ADDR mystr,rax

    invoke  ExitProcess,0

start ENDP

END start


[jack]

👍

[Vortex]

Another version assuming that the string to be searched contains only printable characters :

Code Select Expand

OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE

FindChar PROC src:DWORD,char:DWORD

    mov     eax,DWORD PTR [esp+4]
    mov     ecx,DWORD PTR [esp+8]
    dec     eax
@@:
    inc     eax
    mov     dl,BYTE PTR [eax]
    mov     dh,dl
    xor     dl,cl
    sub     dx,0101h
    or      dl,dh
    cmp     dl,255
    jnz     @b
    retn    8

FindChar ENDP

OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef

[Vortex]

Function determining the extension of a file. FindExt is based on FindChar.

Code Select Expand

OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE

FindExt PROC src:DWORD

    mov     eax,DWORD PTR [esp+4]
    dec     eax
    mov     cl,'.'
@@:
    inc     eax
    mov     dl,BYTE PTR [eax]
    test    dl,dl
    setz    dh
    xor     dl,cl
    setz    ch
    or      ch,dh
    jz      @b
    retn    4

FindExt ENDP

OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef


[TimoVJL]

An interesting code.
Erol, can you add a comments to that code too, so it explain register usage for bytes better.

[Vortex]

PathFindExtension :

https://learn.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-pathfindextensiona

PathCchFindExtension :

https://learn.microsoft.com/en-us/windows/win32/api/pathcch/nf-pathcch-pathcchfindextension

[Vortex]

Hi Timo,

Sorry for the late reply. I modified my posts above to present a better algo. Here are the comments :

Code Select Expand

OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE

FindChar PROC src:DWORD,char:DWORD

eax to point the string to search for a specific character :

    mov     eax,DWORD PTR [esp+4]

ecx holding the character to be found :

    mov     ecx,DWORD PTR [esp+8]

Decrement eax so modifying eax should not interfer with the only jmp jz

    dec     eax
@@:
    inc     eax

Get a byte from eax pointing the string

    mov     dl,BYTE PTR [eax]

Check if it's NULL terminator

    test    dl,dl

If dl is NULL set dh to 1

    setz    dh

If ( dl XOR cl ) == 0 the we found the char we were looking for.

dl XOR cl is zero if dl == cl :

    xor     dl,cl
    setz    ch

If none of the conditions above are met then return back to the top of the loop :   

    or      ch,dh
    jz      @b
    retn    8

FindChar ENDP

OPTION PROLOGUE:PrologueDef
OPTION EPILOGUE:EpilogueDef