Search code examples
cassemblyreverse-engineeringollydbg

Following struct pointers

I'm learning about reversing. I've attached OllyDbg to a program that uses WSASendTo (from WS2_32.dll), and breaks at the call to WSASendTo. When the call is made, the stack looks like the following:

stack layout

According to MSDN, that second argument is a pointer to "an array of WSABUF structures" shown below:

pointer to WSABUF struct

So my question is this: how do I follow the pointers in memory to see the data in memory? Below is a view in OllyDbg of the memory location 0x1970F6B8 (which represents the WSABUF struct referenced from the stack), but from there on, I don't know how this struct is layed out in memory to grab the "char FAR *buf" pointer and find its contents in memory.

memory layout

I've read that the layout of a struct in memory can be compiler-dependent. If so, how does a reverse engineer (or the CPU) determine where the contents of a struct actually exist?

Solution

  • how do I follow the pointers in memory to see the data in memory?

    I think you should be able to just right-click on the pointer and choose "Follow in Dump". Then you can choose 4-byte layout in the dump and again follow the buf pointer via the same procedure. Note that the first word in the __WSABuf struct is the length, so you want the second one (in this case, the address is 0x16450370).

    I've read that the layout of a struct in memory can be compiler-dependent.

    Yes, the compiler has a certain freedom about how it aligns the struct members.

    However, the layout of the ABI structures has to be standardized somehow, to ensure interoperability. I don't know how the WinAPI does this in their header files, maybe using some kind of compiler-specific pragmas controlling the alignment. Or maybe they just assume that the compiler does it like MSVC would do it.