Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
1.15 Structures<br />
It can be defined that C/C++ structure, with some assumptions, just a set of variables, always s<strong>to</strong>red in<br />
memory <strong>to</strong>gether, not necessary of the same type.<br />
1.15.1 SYSTEMTIME example<br />
Let’s take SYSTEMTIME 52 win32 structure describing time.<br />
That’s how it’s defined:<br />
typedef struct _SYSTEMTIME {<br />
WORD wYear;<br />
WORD wMonth;<br />
WORD wDayOfWeek;<br />
WORD wDay;<br />
WORD wHour;<br />
WORD wMinute;<br />
WORD wSecond;<br />
WORD wMilliseconds;<br />
} SYSTEMTIME, *PSYSTEMTIME;<br />
Let’s write a C function <strong>to</strong> get current time:<br />
#include <br />
#include <br />
void main()<br />
{<br />
SYSTEMTIME t;<br />
GetSystemTime (&t);<br />
};<br />
printf ("%04d-%02d-%02d %02d:%02d:%02d\n",<br />
t.wYear, t.wMonth, t.wDay,<br />
t.wHour, t.wMinute, t.wSecond);<br />
return;<br />
We got (MSVC 2010):<br />
_t$ = -16 ; size = 16<br />
_main PROC<br />
push ebp<br />
mov ebp, esp<br />
sub esp, 16 ; 00000010H<br />
lea eax, DWORD PTR _t$[ebp]<br />
push eax<br />
call DWORD PTR __imp__GetSystemTime@4<br />
movzx ecx, WORD PTR _t$[ebp+12] ; wSecond<br />
push ecx<br />
movzx edx, WORD PTR _t$[ebp+10] ; wMinute<br />
push edx<br />
movzx eax, WORD PTR _t$[ebp+8] ; wHour<br />
push eax<br />
movzx ecx, WORD PTR _t$[ebp+6] ; wDay<br />
52 MSDN: SYSTEMTIME structure<br />
65