Reverse Engineering for Beginners

(avery) #1

CHAPTER 21. STRUCTURES CHAPTER 21. STRUCTURES


Chapter 21


Structures


A C/C++ structure, with some assumptions, is just a set of variables, always stored in memory together, not necessary of the
same type^1.


21.1 MSVC: SYSTEMTIME example.


Let’s take the SYSTEMTIME^2 win32 structure that describes time.


This is how it’s defined:


Listing 21.1: WinBase.h

typedef struct _SYSTEMTIME {
WORD wYear;
WORD wMonth;
WORD wDayOfWeek;
WORD wDay;
WORD wHour;
WORD wMinute;
WORD wSecond;
WORD wMilliseconds;
} SYSTEMTIME, *PSYSTEMTIME;


Let’s write a C function to get the current time:


#include <windows.h>
#include <stdio.h>


void main()
{
SYSTEMTIME t;
GetSystemTime (&t);


printf ("%04d-%02d-%02d %02d:%02d:%02d\n",
t.wYear, t.wMonth, t.wDay,
t.wHour, t.wMinute, t.wSecond);

return;
};


We get (MSVC 2010):


Listing 21.2: MSVC 2010 /GS-

_t$ = -16 ; size = 16
_main PROC
push ebp
mov ebp, esp
sub esp, 16
lea eax, DWORD PTR _t$[ebp]


(^1) AKA“heterogeneous container”
(^2) MSDN: SYSTEMTIME structure

Free download pdf