flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
IronFelix
Code: mov eax, [edi + IMAGE_DOS_HEADER.e_lfanew] |
|||
![]() |
|
kilobyte
Right thanks IronFelix, that makes my life easier now. Just for clarification and for the bettering of my understanding, I'm going to try to explain what i believe is happening.
say for example I have the structure declaration Code: struct mystruct fieldA dd ? fieldB dd ? ends and have a base address of allocated memory in edi, that has the layout of mystruct. Is the reason as to why were able to access specific fields in memory because of the fact that mystruct.fieldA is a label/address? (i doubt that this is correct) hmm or is it that were getting the offest of fieldA in relation to mystruct in which we use as an index added to 'edi' to provide the location of that field (in this case fieldA) in memory. So would that mean that Code: mov eax,[edi+mystruct.fieldB] mystruct.fieldB would = 4, as that is the offset at which it is located in mystruct. hmm...well that makes more sense to me, correct me if I'm wrong. Also would this be the same for structures with structures in side of them aswell? |
|||
![]() |
|
hopcode
Hallo kilobyte, i have not understood well what you require, but
for example: Code: struct mystruct fieldA dd ? fieldB dd ? fieldC db 8 dup (?) ends ; instantiate it in the .data section onestruct mystruct Code: mov edx,onestruct mov [onestruct.fieldB],1024 ; is the same as mov [edx+mystruct.fieldB],1024 mov ecx,[edx+mystruct.fieldB] ; ecx wil be 1024 mov ecx,mystruct.fieldB ; ecx will be = 4, offset of fieldB mov ecx,mystruct.fieldC.size ; ecx will be = 8 size of the fieldC mov ecx,mystruct.fieldC ; ecx will be = 8 , offset of fieldC if you have put for example in edx a valid return value from HeapAlloc, you could access the mem layout in the form Code: mov ecx,[edx+mystruct.fieldB] mov [edx+mystruct.fieldB],2048 or using virtual: Code: virtual at edx memstruct mystruct end virtual ; then... zeroing the fieldC ; mov [memstruct.fieldB],1024 lea edi,[memstruct.fieldC] mov ecx,mystruct.fieldC.size xor eax,eax rep stosb NOTE: to use .size you need redefining (if not already redefined), for the case, the db macro as follow: Code: struc db [data] { common . db data .size = $ - . } Regards, hopcode |
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.
Website powered by rwasa.