dereferencing structure members

Question

I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it.

There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like this:

push ebp
mov ebp, esp
mov eax, dword ptr [ebp+8]
mov eax, dword ptr [eax+14]
pop ebp
ret 4

And it occured to me, say there is a member of a structure that is a pointer to some other structure. How would I go about dereferencing that member?

struct example {
  int member1;
  *object member2;
};

Would I be dereferencing member 2 like so (pointer to struct comes as first param):

mov eax, [ebp+8]
mov eax, dword ptr [eax]
mov eax, [eax+8] ; this would get me the pointer to member2???

any input appreciated

EDIT:

I see, your explanation was understandable, thank you, I appreciate it.

I have one more question that popped up from my mind. Say in your example, member 2 is a pointer to an int, then

mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)

Say i would like to get the value of member to into ecx i would carry on like this:

mov eax, [eax]
mov ecx, [eax]

So the whole thing would read like so:

mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)
mov eax, [eax]     ; dereferenfce the pointer that is pointing to member2
mov ecx, [eax]     ; dereference member2 itself that is a pointer to an int

Is this correct?

Answer 1

After compilation, a pointer to a C struct will be pointing to its first element. In your example, [ebp + 8] is a pointer to member1 and you can access a pointer to member2 like this:

mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2

When in any doubt, you can always write a simple program, compile it and check the resulting assembler code. In your case, you could write something like this:

#include <stdio.h>

struct example
{
    int member1;
    void* member2;
};


void initialiseStruct(struct example* e)
{
    e->member1 = 1;
    e->member2 = NULL;
}

int main()
{
    struct example e;
    initialiseStruct(&e);
    return 0;
}

And then compile it and run objdump -dM intel FILENAME to get a snippet like the following one:

0000054d <initialiseStruct>:
 54d:   55                      push   ebp
 54e:   89 e5                   mov    ebp,esp
 550:   e8 6b 00 00 00          call   5c0 <__x86.get_pc_thunk.ax>
 555:   05 83 1a 00 00          add    eax,0x1a83
 55a:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
 55d:   c7 00 01 00 00 00       mov    DWORD PTR [eax],0x1 ; e->member1 = 1
 563:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
 566:   c7 40 04 00 00 00 00    mov    DWORD PTR [eax+0x4],0x0 ; e->member2 = NULL
 56d:   90                      nop
 56e:   5d                      pop    ebp
 56f:   c3                      ret  

Regarding your second question: you should view [] in assembly like * in C in case of mov.

If member2 points to int, you can access this integer this way (I've added C equivalents next to each assembly instruction):

mov eax, [ebp + 8] ; eax = e - remember, in my example e is a pointer
mov eax, [eax + 4] ; eax = *(e + 4) = e->member2, so now eax contains the memory address at e->member2
mov ecx, [eax] ; ecx = *(e->member2) - ecx contains the integer value