Reverse Engineering for Beginners

CHAPTER 21. STRUCTURES CHAPTER 21. STRUCTURES

#include <windows.h>
#include <stdio.h>

void main()
{
WORD array[8];
GetSystemTime (array);

printf ("%04d-%02d-%02d %02d:%02d:%02d\n",

array[0] /* wYear */, array[1] /* wMonth */, array[3] /* wDay */,

array[4] /* wHour */, array[5] /* wMinute */, array[6] /* wSecond */);

return;
};

The compiler grumbles a bit:

systemtime2.c(7) : warning C4133: 'function' : incompatible types - from 'WORD [8]' to '⤦
ÇLPSYSTEMTIME'

But nevertheless, it produces this code:

Listing 21.3: Non-optimizing MSVC 2010

$SG78573 DB '%04d-%02d-%02d %02d:%02d:%02d', 0aH, 00H

_array$ = -16 ; size = 16
_main PROC
push ebp
mov ebp, esp
sub esp, 16
lea eax, DWORD PTR _array$[ebp]
push eax
call DWORD PTR impGetSystemTime@4
movzx ecx, WORD PTR _array$[ebp+12] ; wSecond
push ecx
movzx edx, WORD PTR _array$[ebp+10] ; wMinute
push edx
movzx eax, WORD PTR _array$[ebp+8] ; wHoure
push eax
movzx ecx, WORD PTR _array$[ebp+6] ; wDay
push ecx
movzx edx, WORD PTR _array$[ebp+2] ; wMonth
push edx
movzx eax, WORD PTR _array$[ebp] ; wYear
push eax
push OFFSET $SG78573
call _printf
add esp, 28
xor eax, eax
mov esp, ebp
pop ebp
ret 0
_main ENDP

And it works just as the same!

It is very interesting that the result in assembly form cannot be distinguished from the result of the previous compilation.
So by looking at this code, one cannot say for sure if there was a structure declared, or an array.

Nevertheless, no sane person would do it, as it is not convenient. Also the structure fields may be changed by developers,
swapped, etc.

We will not study this example in OllyDbg, because it will be just the same as in the case with the structure.

21.2 Let’s allocate space for a structure using malloc()

Sometimes it is simpler to place structures not the in local stack, but in theheap: