# dereferencing structure members

I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it.

There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like this:

``````push ebp
mov ebp, esp
mov eax, dword ptr [ebp+8]
mov eax, dword ptr [eax+14]
pop ebp
ret 4
``````

And it occured to me, say there is a member of a structure that is a pointer to some other structure. How would I go about dereferencing that member?

``````struct example {
int member1;
*object member2;
};
``````

Would I be dereferencing member 2 like so (pointer to struct comes as first param):

``````mov eax, [ebp+8]
mov eax, dword ptr [eax]
mov eax, [eax+8] ; this would get me the pointer to member2???
``````

any input appreciated

EDIT:

I see, your explanation was understandable, thank you, I appreciate it.

I have one more question that popped up from my mind. Say in your example, member 2 is a pointer to an int, then

``````mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)
``````

Say i would like to get the value of member to into ecx i would carry on like this:

``````mov eax, [eax]
mov ecx, [eax]
``````

So the whole thing would read like so:

``````mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)
mov eax, [eax]     ; dereferenfce the pointer that is pointing to member2
mov ecx, [eax]     ; dereference member2 itself that is a pointer to an int
``````

Is this correct?

After compilation, a pointer to a C struct will be pointing to its first element. In your example, `[ebp + 8]` is a pointer to `member1` and you can access a pointer to `member2` like this:

``````mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2
``````

When in any doubt, you can always write a simple program, compile it and check the resulting assembler code. In your case, you could write something like this:

``````#include <stdio.h>

struct example
{
int member1;
void* member2;
};

void initialiseStruct(struct example* e)
{
e->member1 = 1;
e->member2 = NULL;
}

int main()
{
struct example e;
initialiseStruct(&e);
return 0;
}
``````

And then compile it and run `objdump -dM intel FILENAME` to get a snippet like the following one:

``````0000054d <initialiseStruct>:
54d:   55                      push   ebp
54e:   89 e5                   mov    ebp,esp
550:   e8 6b 00 00 00          call   5c0 <__x86.get_pc_thunk.ax>
555:   05 83 1a 00 00          add    eax,0x1a83
55a:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
55d:   c7 00 01 00 00 00       mov    DWORD PTR [eax],0x1 ; e->member1 = 1
563:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
566:   c7 40 04 00 00 00 00    mov    DWORD PTR [eax+0x4],0x0 ; e->member2 = NULL
56d:   90                      nop
56e:   5d                      pop    ebp
56f:   c3                      ret
``````

Regarding your second question: you should view `[]` in assembly like `*` in C in case of `mov`.

If `member2` points to `int`, you can access this integer this way (I've added C equivalents next to each assembly instruction):

``````mov eax, [ebp + 8] ; eax = e - remember, in my example e is a pointer
mov eax, [eax + 4] ; eax = *(e + 4) = e->member2, so now eax contains the memory address at e->member2
mov ecx, [eax] ; ecx = *(e->member2) - ecx contains the integer value
``````
• moved to reply for better identation – geo10 May 29 at 12:58
• thank you, clear – geo10 May 29 at 13:32