Quick introduction to reverse engineering for beginners

};
int b;
struct outer_struct
{
char a;
int b;
struct inner_struct c;
char d;
int e;
};
void f(struct outer_struct s)
{
printf ("a=%d; b=%d; c.a=%d; c.b=%d; d=%d; e=%d\n",
s.a, s.b, s.c.a, s.c.b, s.d, s.e);
};
... in this case, both inner_struct fields will be placed between a,b and d,e fields of outer_struct.
Let’s compile (MSVC 2010):
_s$ = 8 ; size = 24
_f PROC
push ebp
mov ebp, esp
mov eax, DWORD PTR _s$[ebp+20] ; e
push eax
movsx ecx, BYTE PTR _s$[ebp+16] ; d
push ecx
mov edx, DWORD PTR _s$[ebp+12] ; c.b
push edx
mov eax, DWORD PTR _s$[ebp+8] ; c.a
push eax
mov ecx, DWORD PTR _s$[ebp+4] ; b
push ecx
movsx edx, BYTE PTR _s$[ebp] ;a
push edx
push OFFSET $SG2466
call _printf
add esp, 28 ; 0000001cH
pop ebp
ret 0
_f ENDP
One curious point here is that by looking onto this assembler code, we do not even see that another
structure was used inside of it! Thus, we would say, nested structures are finally unfolds into linear or
one-dimensional structure.
Of course, if to replace struct inner_struct c; declaration to struct inner_struct *c; (thus making
a pointer here) situation will be significally different.
1.15.6 Bit fields in structure
CPUID example
C/C++ language allow to define exact number of bits for each structure fields. It’s very useful if one need to
save memory space. For example, one bit is enough for variable of bool type. But of course, it’s not rational
71