[FASM] CopyMem

Here's an example on how you can move bytes to memory instead of using the normal WinAPI.

Hidden Content

You must

[To see links please register here]

or

[To see links please register here]

to view this content.

(11-29-2016, 09:54 PM)Jochen Wrote:

[To see links please register here]

Here's an example on how you can move bytes to memory instead of using the normal WinAPI.

Hidden Content

You must

[To see links please register here]

or

[To see links please register here]

to view this content.

This won't work for overlapping buffers though.

@bitm0de: Can you explain what you mean with "overlapping buffers" ?
I think your talking about something totally different ..

(11-30-2016, 07:43 AM)Jochen Wrote:

[To see links please register here]

@bitm0de: Can you explain what you mean with "overlapping buffers" ?
I think your talking about something totally different ..

Nope. I'm talking specifically about copying memory from src to dst when those memory regions are overlapping. 'rep movsb' was not designed for this. A better implementation would check the offsets to make sure that this isn't the case, and use some other looping method perhaps to copy bytes from src to dst instead in such a case.

(11-30-2016, 08:07 AM)bitm0de Wrote:

[To see links please register here]

(11-30-2016, 07:43 AM)Jochen Wrote:

[To see links please register here]

@bitm0de: Can you explain what you mean with "overlapping buffers" ?
I think your talking about something totally different ..

Nope. I'm talking specifically about copying memory from src to dst when those memory regions are overlapping. 'rep movsb' was not designed for this. A better implementation would check the offsets to make sure that this isn't the case, and use some other looping method perhaps to copy bytes from src to dst instead in such a case.

@bitm0de: Okay .. I found quote "The source memory block, which is defined by Source and Length, can overlap the destination memory block, which is defined by Destination and Length." But i still dont understand what overlapping means here .. I always used this proc as an replacement of the RtlCopyMemory API with no problems" The quote comes from

[To see links please register here]

So you are right in every way, but i still have allot to learn still... thx for the comment

The misleading thing here is that in most cases while debugging, IDA for instance will replace instances of memcpy with rep movsb, but I'm pretty sure that is a conditional replacement if found that the memory regions do not contain addresses and offsets that interfere with each other. For the most part it's an optimization thing. Things like memmove do support overlapping memory blocks and won't invoke undefined behavior like memcpy will.

(11-30-2016, 06:01 PM)bitm0de Wrote:

[To see links please register here]

The misleading thing here is that in most cases while debugging, IDA for instance will replace instances of memcpy with rep movsb, but I'm pretty sure that is a conditional replacement if found that the memory regions do not contain addresses and offsets that interfere with each other. For the most part it's an optimization thing. Things like memmove do support overlapping memory blocks and won't invoke undefined behavior like memcpy will.

Okay :smile: thx for the info. i like learning new things once in while.