Reverse Engineering for Beginners

CHAPTER 21. STRUCTURES CHAPTER 21. STRUCTURES

#include <windows.h>
#include <stdio.h>

void main()
{
SYSTEMTIME *t;

t=(SYSTEMTIME *)malloc (sizeof (SYSTEMTIME));

GetSystemTime (t);

printf ("%04d-%02d-%02d %02d:%02d:%02d\n",

t->wYear, t->wMonth, t->wDay,

t->wHour, t->wMinute, t->wSecond);

free (t);

return;
};

Let’s compile it now with optimization (/Ox) so it would be easy see what we need.

Listing 21.4: Optimizing MSVC

_main PROC
push esi
push 16
call _malloc
add esp, 4
mov esi, eax
push esi
call DWORD PTR impGetSystemTime@4
movzx eax, WORD PTR [esi+12] ; wSecond
movzx ecx, WORD PTR [esi+10] ; wMinute
movzx edx, WORD PTR [esi+8] ; wHour
push eax
movzx eax, WORD PTR [esi+6] ; wDay
push ecx
movzx ecx, WORD PTR [esi+2] ; wMonth
push edx
movzx edx, WORD PTR [esi] ; wYear
push eax
push ecx
push edx
push OFFSET $SG78833
call _printf
push esi
call _free
add esp, 32
xor eax, eax
pop esi
ret 0
_main ENDP

So,sizeof(SYSTEMTIME) = 16and that is exact number of bytes to be allocated bymalloc(). It returns a pointer
to a freshly allocated memory block in theEAXregister, which is then moved into theESIregister.GetSystemTime()
win32 function takes care of saving value inESI, and that is why it is not saved here and continues to be used after the
GetSystemTime()call.

New instruction —MOVZX(Move with Zero eXtend). It may be used in most cases asMOVSX, but it sets the remaining bits to

0. That’s becauseprintf()requires a 32-bitint, but we got a WORD in the structure —that is 16-bit unsigned type. That’s
   why by copying the value from a WORD intoint, bits from 16 to 31 must be cleared, because a random noise may be there,
   which is left from the previous operations on the register(s).

In this example, it’s possible to represent the structure as an array of 8 WORDs:

#include <windows.h>
#include <stdio.h>

void main()