Reverse Engineering for Beginners

CHAPTER 21. STRUCTURES CHAPTER 21. STRUCTURES

; print carriage return character (CR)

mov dword ptr [esp], 0Ah ; c

add esi, 4

call _putchar

cmp esi, edi ; meet struct end?

jnz short loc_8048408 ; j=0

lea esp, [ebp-0Ch]

pop ebx

pop esi

pop edi

pop ebp

retn

main endp

21.4 Fields packing in structure.

One important thing is fields packing in structures^6.

Let’s take a simple example:

#include <stdio.h>

struct s

{

char a;

int b;

char c;

int d;

};

void f(struct s s)

{

printf ("a=%d; b=%d; c=%d; d=%d\n", s.a, s.b, s.c, s.d);

};

int main()

{

struct s tmp;

tmp.a=1;

tmp.b=2;

tmp.c=3;

tmp.d=4;

f(tmp);

};

As we see, we have twocharfields (each is exactly one byte) and two more —int(each — 4 bytes).

21.4.1 x86

This compiles to:

Listing 21.16: MSVC 2012 /GS- /Ob0
1 _tmp$ = -16
2 _main PROC
3 push ebp
4 mov ebp, esp
5 sub esp, 16
6 mov BYTE PTR _tmp$[ebp], 1 ; set field a
7 mov DWORD PTR _tmp$[ebp+4], 2 ; set field b
8 mov BYTE PTR _tmp$[ebp+8], 3 ; set field c
9 mov DWORD PTR _tmp$[ebp+12], 4 ; set field d
10 sub esp, 16 ; allocate place for temporary structure
11 mov eax, esp
12 mov ecx, DWORD PTR _tmp$[ebp] ; copy our structure to the temporary one

(^6) See also:Wikipedia: Data structure alignment