Reverse Engineering for Beginners

(avery) #1

CHAPTER 21. STRUCTURES CHAPTER 21. STRUCTURES


push eax
call DWORD PTR impGetSystemTime@4
movzx ecx, WORD PTR _t$[ebp+12] ; wSecond
push ecx
movzx edx, WORD PTR _t$[ebp+10] ; wMinute
push edx
movzx eax, WORD PTR _t$[ebp+8] ; wHour
push eax
movzx ecx, WORD PTR _t$[ebp+6] ; wDay
push ecx
movzx edx, WORD PTR _t$[ebp+2] ; wMonth
push edx
movzx eax, WORD PTR _t$[ebp] ; wYear
push eax
push OFFSET $SG78811 ; '%04d-%02d-%02d %02d:%02d:%02d', 0aH, 00H
call _printf
add esp, 28
xor eax, eax
mov esp, ebp
pop ebp
ret 0
_main ENDP


16 bytes are allocated for this structure in the local stack —that is exactlysizeof(WORD)*8(there are 8 WORD variables
in the structure).


Pay attention to the fact that the structure begins with thewYearfield. It can be said that a pointer to the SYSTEMTIME
structure is passed to theGetSystemTime()^3 , but it is also can be said that a pointer to thewYearfield is passed, and
that is the same!GetSystemTime()writes the current year to the WORD pointer pointing to, then shifts 2 bytes ahead,
writes current month, etc, etc.


(^3) MSDN: SYSTEMTIME structure

Free download pdf