Quick introduction to reverse engineering for beginners

push ecx
movzx edx, WORD PTR _t$[ebp+2] ; wMonth
push edx
movzx eax, WORD PTR _t$[ebp] ; wYear
push eax
push OFFSET $SG78811 ; ’%04d-%02d-%02d %02d:%02d:%02d’, 0aH, 00H
call _printf
add esp, 28 ; 0000001cH
xor eax, eax
mov esp, ebp
pop ebp
ret 0
_main ENDP
16 bytes are allocated for this structure in local stack — that’s exactly sizeof(WORD)*8 (there are 8
WORD variables in the structure).
Take a note: the structure beginning with wYear field. It can be said, an pointer to SYSTEMTIME
structure is passed to GetSystemTime() 53 , but it’s also can be said, pointer to wYear field is passed, and
that’s the same! GetSystemTime() writting current year to the WORD pointer pointing to, then shifting 2
bytes ahead, then writting current month, etc, etc.
1.15.2 Let’s allocate place for structure using malloc()
However, sometimes it’s simpler to place structures not in local stack, but in heap:
#include
#include
void main()
{
SYSTEMTIME *t;
};
t=(SYSTEMTIME *)malloc (sizeof (SYSTEMTIME));
GetSystemTime (t);
printf ("%04d-%02d-%02d %02d:%02d:%02d\n",
t->wYear, t->wMonth, t->wDay,
t->wHour, t->wMinute, t->wSecond);
free (t);
return;
Let’s compile it now with optimization (/Ox) so to easily see what we need.
_main PROC
push esi
push 16 ; 00000010H
call _malloc
add esp, 4
mov esi, eax
push esi
53 MSDN: SYSTEMTIME structure
66