Working with Structures

Index > Windows > Working with Structures

Author

Thread

kilobyte

Joined: 07 Jun 2008
Posts: 15

kilobyte

hey guys i have a new question.

I was wondering if it is possible to superimpose a structure template over a block of memory. Say for example I have a PE file mapped in memory at location 00200000, and this is in EDI; could i do something like:

Code:

mov eax,dword [edi.IMAGE_DOS_HEADER.e_lfanew]

Dos Header structure.

Code:

; DOS Header
struct IMAGE_DOS_HEADER
    e_magic     dw ?            ;Magic number 
    e_cblp      dw ?            ;Bytes on last page of file
    e_cp        dw ?            ;Pages in file
    e_crlc      dw ?            ;Relocations
    e_cparhdr   dw ?            ;Size of header in paragraphs
    e_minalloc  dw ?            ;Minimum extra paragraphs needed
    e_maxalloc  dw ?            ;Maximum extra paragraphs needed
    e_ss        dw ?            ;Initial (relative) SS value
    e_sp        dw ?            ;Initial SP value
    e_csum      dw ?            ;Checksum
    e_ip        dw ?            ;Initial IP value
    e_cs        dw ?            ;Initial (relative) CS value
    e_lfarlc    dw ?            ;File address of relocation table
    e_ovno      dw ?            ;Overlay
    e_res       dw 4 dup(?)     ;Reserved words
    e_oemid     dw ?            ;OEM identifier (for e_oeminfo)
    e_oeminfo   dw ?            ;OEM information; e_oemid specific
    e_res2      dw 10 dup(?)    ;Reserved words
    e_lfanew    dd ?            ;File address of new exe header
ends

I tried looking in the manuals for some examples but couldn't see any so don't really no if that is possible. If not is there a way of achieving similar functionality. Thanks in advance

24 Jun 2009, 07:19

IronFelix

Joined: 09 Dec 2004
Posts: 141
Location: Russia, Murmansk region

IronFelix

Code:

mov eax, [edi + IMAGE_DOS_HEADER.e_lfanew]

24 Jun 2009, 08:03

kilobyte

Joined: 07 Jun 2008
Posts: 15

kilobyte

Right thanks IronFelix, that makes my life easier now. Just for clarification and for the bettering of my understanding, I'm going to try to explain what i believe is happening.

say for example I have the structure declaration

Code:

struct mystruct
    fieldA dd ?
    fieldB dd ?
ends

and have a base address of allocated memory in edi, that has the layout of mystruct. Is the reason as to why were able to access specific fields in memory because of the fact that mystruct.fieldA is a label/address? (i doubt that this is correct) hmm or is it that were getting the offest of fieldA in relation to mystruct in which we use as an index added to 'edi' to provide the location of that field (in this case fieldA) in memory. So would that mean that

Code:

mov eax,[edi+mystruct.fieldB]

mystruct.fieldB would = 4, as that is the offset at which it is located in mystruct.
hmm...well that makes more sense to me, correct me if I'm wrong. Also would this be the same for structures with structures in side of them aswell?

24 Jun 2009, 09:14

hopcode

Joined: 04 Mar 2008
Posts: 563
Location: Germany

hopcode

Hallo kilobyte, i have not understood well what you require, but
for example:

Code:

struct mystruct
  fieldA dd ?
  fieldB dd ?
  fieldC db 8 dup (?)
ends
; instantiate it in the .data section
 onestruct mystruct

Code:

mov edx,onestruct
mov [onestruct.fieldB],1024      ; is the same as mov [edx+mystruct.fieldB],1024
mov ecx,[edx+mystruct.fieldB] ; ecx wil be 1024
mov ecx,mystruct.fieldB           ; ecx will be = 4, offset of fieldB
mov ecx,mystruct.fieldC.size     ; ecx will be = 8 size of the fieldC
mov ecx,mystruct.fieldC           ; ecx will be = 8 , offset of fieldC

if you have put for example in edx a valid return value from HeapAlloc, you could access the mem layout in the form

Code:

mov ecx,[edx+mystruct.fieldB]
mov [edx+mystruct.fieldB],2048

or using virtual:

Code:

virtual at edx
  memstruct mystruct
end virtual

; then... zeroing the fieldC
;
mov [memstruct.fieldB],1024
lea edi,[memstruct.fieldC]
mov ecx,mystruct.fieldC.size
xor eax,eax
rep stosb

NOTE:
to use .size you need redefining (if not already redefined), for the case,
the db macro as follow:

Code:

struc db [data]    {
      common
      . db data
   .size = $ - .
}

Regards,
hopcode

24 Jun 2009, 10:47

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum