0

I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it.

There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like this:

push ebp
mov ebp, esp
mov eax, dword ptr [ebp+8]
mov eax, dword ptr [eax+14]
pop ebp
ret 4

And it occured to me, say there is a member of a structure that is a pointer to some other structure. How would I go about dereferencing that member?

struct example {
  int member1;
  *object member2;
};

Would I be dereferencing member 2 like so (pointer to struct comes as first param):

mov eax, [ebp+8]
mov eax, dword ptr [eax]
mov eax, [eax+8] ; this would get me the pointer to member2???

any input appreciated

EDIT:

I see, your explanation was understandable, thank you, I appreciate it.

I have one more question that popped up from my mind. Say in your example, member 2 is a pointer to an int, then

mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)

Say i would like to get the value of member to into ecx i would carry on like this:

mov eax, [eax]
mov ecx, [eax]

So the whole thing would read like so:

mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)
mov eax, [eax]     ; dereferenfce the pointer that is pointing to member2
mov ecx, [eax]     ; dereference member2 itself that is a pointer to an int

Is this correct?

0

After compilation, a pointer to a C struct will be pointing to its first element. In your example, [ebp + 8] is a pointer to member1 and you can access a pointer to member2 like this:

mov eax, [ebp + 8] ; eax contains pointer to struct and its first member
mov eax, [eax + 4] ; eax contains a pointer to member2

When in any doubt, you can always write a simple program, compile it and check the resulting assembler code. In your case, you could write something like this:

#include <stdio.h>

struct example
{
    int member1;
    void* member2;
};


void initialiseStruct(struct example* e)
{
    e->member1 = 1;
    e->member2 = NULL;
}

int main()
{
    struct example e;
    initialiseStruct(&e);
    return 0;
}

And then compile it and run objdump -dM intel FILENAME to get a snippet like the following one:

0000054d <initialiseStruct>:
 54d:   55                      push   ebp
 54e:   89 e5                   mov    ebp,esp
 550:   e8 6b 00 00 00          call   5c0 <__x86.get_pc_thunk.ax>
 555:   05 83 1a 00 00          add    eax,0x1a83
 55a:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
 55d:   c7 00 01 00 00 00       mov    DWORD PTR [eax],0x1 ; e->member1 = 1
 563:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
 566:   c7 40 04 00 00 00 00    mov    DWORD PTR [eax+0x4],0x0 ; e->member2 = NULL
 56d:   90                      nop
 56e:   5d                      pop    ebp
 56f:   c3                      ret  

Regarding your second question: you should view [] in assembly like * in C in case of mov.

If member2 points to int, you can access this integer this way (I've added C equivalents next to each assembly instruction):

mov eax, [ebp + 8] ; eax = e - remember, in my example e is a pointer
mov eax, [eax + 4] ; eax = *(e + 4) = e->member2, so now eax contains the memory address at e->member2
mov ecx, [eax] ; ecx = *(e->member2) - ecx contains the integer value
| improve this answer | |
  • moved to reply for better identation – geo10 May 29 at 12:58
  • thank you, clear – geo10 May 29 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.