Quick introduction to reverse engineering for beginners

1.15.4 Fields packing in structure
One important thing is fields packing in structures 54 .
Let’s take a simple example:
#include
struct s
{
char a;
int b;
char c;
int d;
};
void f(struct s s)
{
printf ("a=%d; b=%d; c=%d; d=%d\n", s.a, s.b, s.c, s.d);
};
As we see, we have two char fields (each is exactly one byte) and two more — int (each - 4 bytes).
That’s all compiling into:
_s$ = 8 ; size = 16
?f@@YAXUs@@@Z PROC ; f
push ebp
mov ebp, esp
mov eax, DWORD PTR _s$[ebp+12]
push eax
movsx ecx, BYTE PTR _s$[ebp+8]
push ecx
mov edx, DWORD PTR _s$[ebp+4]
push edx
movsx eax, BYTE PTR _s$[ebp]
push eax
push OFFSET $SG3842
call _printf
add esp, 20 ; 00000014H
pop ebp
ret 0
?f@@YAXUs@@@Z ENDP ; f
_TEXT ENDS
As we can see, each field’s address is aligned by 4-bytes border. That’s why each char using 4 bytes here,
like int. Why? Thus it’s easier for CPU to access memory at aligned addresses and to cache data from it.
However, it’s not very economical in size sense.
Let’s try to compile it with option (/Zp1) (/Zp[n] pack structs on n-byte boundary).
_TEXT SEGMENT
_s$ = 8 ; size = 10
?f@@YAXUs@@@Z PROC ; f
push ebp
mov ebp, esp
mov eax, DWORD PTR _s$[ebp+6]
push eax
54 See also: Wikipedia: Data structure alignment
69