How do you recognize memcpy, memset, and strlen in compiled assembly?

They show up either as call <name@PLT> library calls or as inlined rep-prefixed string instructions (rep movsb, rep stosb, repne scasb).

* Inlined string ops: the rep-prefixed instruction tells you which C library routine the compiler expanded. *

Inlined memcpy:

# Copy rcx bytes from rsi to rdi
mov  %rdx, %rcx
rep movsb

Or for aligned copies: rep movsq (copies 8 bytes at a time).

Inlined memset:

# Fill rcx bytes at rdi with al
xor  %eax, %eax
mov  $0x100, %ecx
rep stosb

Inlined strlen:

# Find null byte in string at rdi
xor  %eax, %eax
mov  $-1, %rcx
repne scasb
not  %rcx
dec  %rcx

As library calls:

• memcpy(dst, src, n): %rdi = dst, %rsi = src, %rdx = n
• memset(ptr, val, n): %rdi = ptr, %esi = value, %rdx = n
• strlen(s): %rdi = string, returns length in %rax

Forensic relevance: Malware often uses these to manipulate buffers. Recognizing them helps you understand what data is being moved/modified.

Go deeper:

• Intel MOVS/MOVSB reference — rep movsb block-copies ECX bytes from (RSI) to (RDI), the inlined memcpy
• Intel SCAS/SCASB reference — the byte-scan that repne scasb uses to inline strlen
• x86 instruction listings — MOVS/STOS/SCAS string ops and their REP prefixes in context