Reverse Engineering for Beginners

(avery) #1

CHAPTER 9. MORE ABOUT RESULTS RETURNING CHAPTER 9. MORE ABOUT RESULTS RETURNING


...what we got (MSVC 2010/Ox):


$T3853 = 8 ; size = 4
_a$ = 12 ; size = 4
?get_some_values@@YA?AUs@@H@Z PROC ; get_some_values
mov ecx, DWORD PTR _a$[esp-4]
mov eax, DWORD PTR $T3853[esp-4]
lea edx, DWORD PTR [ecx+1]
mov DWORD PTR [eax], edx
lea edx, DWORD PTR [ecx+2]
add ecx, 3
mov DWORD PTR [eax+4], edx
mov DWORD PTR [eax+8], ecx
ret 0
?get_some_values@@YA?AUs@@H@Z ENDP ; get_some_values


The macro name for internal passing of pointer to a structure here is$T3853.


This example can be rewritten using the C99 language extensions:


struct s
{
int a;
int b;
int c;
};


struct s get_some_values (int a)
{
return (struct s){.a=a+1, .b=a+2, .c=a+3};
};


Listing 9.3: GCC 4.8.1

_get_some_values proc near


ptr_to_struct = dword ptr 4
a = dword ptr 8


mov edx, [esp+a]
mov eax, [esp+ptr_to_struct]
lea ecx, [edx+1]
mov [eax], ecx
lea ecx, [edx+2]
add edx, 3
mov [eax+4], ecx
mov [eax+8], edx
retn
_get_some_values endp


As we see, the function is just filling the structure’s fields allocated by the caller function, as if a pointer to the structure was
passed. So there are no performance drawbacks.

Free download pdf