Finding escape characters in AT&T x86 assembly - string

Question

Question 1: I have the following assembler code, whose purpose is to loop through an input string, and count the number of escape characters '%' it encounters:
.globl sprinter
.data
.escape_string: .string "%"
.num_escape: .long 0
.num_characters: .long 0
.text
sprinter:
pushl %ebp
movl %esp,%ebp
movl 8(%ebp),%ecx # %ecx = parameter 1
loop:
cmpb $0, (%ecx) # if end of string reached
jz exit
cmpl $.escape_string,(%ecx) # if escape character found
je increment
back:
incl .num_characters
incl %ecx
jmp loop
increment:
incl .num_escape
jmp back # jump to 'back'
exit:
movl .num_escape, %eax # return num_escape
popl %ebp
ret
This assembly code is compiled together with the following C code:
#include <stdio.h>
extern int sprinter (char* string);
int main (void)
{
int n = sprinter("a %d string of some %s fashion!");
printf("value: %d",n);
return 0;
}
The expected output from running this code is value: 2 (because there are two '%' characters in the string), but it returns value: 0, meaning the following line fails (because it never increments the counter):
cmpl $.escape_string,(%ecx) # if escape character found
Am I using the wrong method of comparing for the string? The outer loop works fine, and .num_characters correctly contains the number of characters in my string. I generated some assembly code for a simple C-program that compared a string "hello" to "hello2", and this is the relevant code:
.LC0:
.string "hello"
.LC1:
.string "hello2"
...
movl $.LC0, -4(%ebp)
cmpl $.LC1, -4(%ebp)
It looks very similar to what I tried, no?
Question 2. This code is part of what is going to be a simplified sprintf-function written in assembly. This means the first parameter should be the result string, and the second parameter is the formatting. How do I copy a byte character from our current position in one register to our current position in another register? Let's assume we've assigned our parameters into two registers:
movl 8(%ebp),%edx # %edx = result-string
movl 12(%ebp),%ecx # %ecx = format-string
I tried the following in the loop:
movb (%ecx), %al
movb %al, (%edx) # copy current character to current position in result register
incl %ecx
incl %edx
But the result string just contains a (the first character in my string), and not the full string as I expected.
All help appreciated because this comparison problem (question 1) is currently keeping me stuck.

Answer 1

In regards to question 1, it appears that you are comparing single byte chars so 'cmpl' should be 'cmpb' when checking for the escape character. You will also need to load your character into a register. I'm not really familiar with AT&T assembly, so I hope this is correct.
Before loop:
movb .escape_string, %al
Comparison:
cmpb %al, %(ecx)