Me vs the 90s game, part two.
I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets called. The function is given a pointer to a _SYSTEMTIME struct (16 bytes) that gets filled. GetSystemTime() works the same way and has the same signature etc.

Here you can find a bad paint job showing the dissasembler listing of the function calling GetLocalTime() and the decompiler output. I'm sorry for the suboptimal format, I didn't want to include a huge code block and my screen is rather small. It should be legible though.

Now to my questions:

  • Could it be that the compiler broke the _SYSTEMTIME into four undefined4s local_cc/_c4/_c8/_c0, with local_cc being the "start"?
  • If so, how do I get Ghidra to display it like a struct? I haven't found anything useful online and Retype Variable doesn't do anything useful.
  • As an added bonus, how do you get the names of the struct parts to show if Ghidra doesn't do it by itself? It knows the struct, but chooses not to show the names somethimes.
  • One last question: Is my understanding correct, that (WORD) local_cc == _SYSTEMTIME.wYear and local_cc._2_2_ == _SYSTEMTIME.wMonth, if the struct was indeed split up?

Thank you very much in advance!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.