Skip to main content
Reverse Engineering

Return to Question

edited body
Source Link
Ken Bellows
Ken Bellows
  • 353
  • 4
  • 8

I took a basic 40-hr Reverse Engineering course a few summers ago. WholeWhile teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain variables in the ASM as members of a structure, basically equivalent to a good old fashioned struct in C/C++, and treat them as such wherever they are seen in the rest of the code. This seems rather useful to me.

What he did not cover, however, was how to identify a structure. How do you know when a group of variables does in fact constitute a structure and not just a set of related variables? How can you be sure that the author used a struct (or something similar) there?

I took a basic 40-hr Reverse Engineering course a few summers ago. Whole teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain variables in the ASM as members of a structure, basically equivalent to a good old fashioned struct in C/C++, and treat them as such wherever they are seen in the rest of the code. This seems rather useful to me.

What he did not cover, however, was how to identify a structure. How do you know when a group of variables does in fact constitute a structure and not just a set of related variables? How can you be sure that the author used a struct (or something similar) there?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain variables in the ASM as members of a structure, basically equivalent to a good old fashioned struct in C/C++, and treat them as such wherever they are seen in the rest of the code. This seems rather useful to me.

What he did not cover, however, was how to identify a structure. How do you know when a group of variables does in fact constitute a structure and not just a set of related variables? How can you be sure that the author used a struct (or something similar) there?

Tweeted twitter.com/#!/StackReverseEng/status/320249199457337344
Source Link
Ken Bellows
Ken Bellows
  • 353
  • 4
  • 8

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. Whole teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain variables in the ASM as members of a structure, basically equivalent to a good old fashioned struct in C/C++, and treat them as such wherever they are seen in the rest of the code. This seems rather useful to me.

What he did not cover, however, was how to identify a structure. How do you know when a group of variables does in fact constitute a structure and not just a set of related variables? How can you be sure that the author used a struct (or something similar) there?