News:

Masm32 SDK description, downloads and other helpful links
Message to All Guests
NB: Posting URL's See here: Posted URL Change

Main Menu

Cpp Struct to Masm

Started by ragdog, January 16, 2016, 06:55:39 AM

Previous topic - Next topic

ragdog

Hello

I translate a cpp Structur to Masm  but i have a mistake


typedef struct _HVITEM {
    UINT Mask;
    UINT State;
    ULONG64 Address;
    SIZE_T NumberOfItem;
    BYTE Value;
    } HVITEM, *PHVITEM;

typedef struct _NMHVDISPINFO {
    NMHDR NmHdr;
    HVITEM Item;
    } NMHVDISPINFO, *PNMHVDISPINFO;



My Translate is


HVITEM struct
Mask_ DWORD ? ;[eax+10h]
State DWORD ? ;[eax+14h]
Address ULONG64 ? ;[eax+18h]  eax   [eax+1Ch] edx   ULONG64 = qword
NumberOfItem DWORD ? ;[eax+20h]
Value BYTE ? ;[eax+24h]
HVITEM ends

PHVITEM typedef ptr HVITEM

NMHVDISPINFO struct
NmHdr NMHDR <>  ;3 dword´s
dword ?                 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Item HVITEM <>  ;1 +
NMHVDISPINFO ends


I have test it with a little Cpp example to get the sizeof Struct

This return the struct size 40 decimal
  printf("%d\n\n",sizeof(NMHVDISPINFO));


I have make from cpp project a assemply output to get the pointer to the struct entrys and all [eax+xx] is correct
in my HVITEM struct.

But i must add a dword in the NMHVDISPINFO but why.

Can any tell me where is the mistake?

Regards,

qWord

Because there is a 64bit integer in the structure and the default alignment for structures in windows is 8, the second member must be aligned by 8. MASM do that for you if you write a 8 after the keyword STRUCT (or use the cmd-line option /Zp8).

HVITEM struct 8 ; (due to order, HVITEM.Address is alrady aligned to 8)
...
NMHVDISPINFO struct 8 ; <-- needed
...
MREAL macros - when you need floating point arithmetic while assembling!

qWord

BTW; "ULONG64 Address" looks suspicious: the name implies a pointer type, which should be 32Bit.
MREAL macros - when you need floating point arithmetic while assembling!

ragdog

Thank you Qword

For the  align trick.

BTW; "ULONG64 Address" looks suspicious: the name implies a pointer type, which should be 32Bit then.

Why suspicious ULONG64 is your name  :biggrin:

Windows.inc
ULONG64                     typedef QWORD

This works with 32bit address and 64bit

How i can find ou if a struct already aligned or not?
In Olly?

Edit:Works fine


qWord

Quote from: ragdog on January 16, 2016, 08:11:33 AM
How i can find ou if a struct already aligned or not?
In Olly?
not sure what you mean.
MREAL macros - when you need floating point arithmetic while assembling!

ragdog

YOu have found the mistake that the struct is not aligned  by 8.

How do you know?

And must i each next members set a  aligned by 4/8 etc?

Example

my Struct
Qword ?
my ends

my1 Struct 8
my1 ends

my2 Struct 8
my2 ends

Or only this one after the member what use the Qword?

qWord

Quote from: ragdog on January 16, 2016, 09:12:22 AM
How do you know?
long a go i stumbled in the same problem. My favorite search engine told me the answer.

Quote from: ragdog on January 16, 2016, 09:12:22 AM
And must i each next members set a  aligned by 4/8 etc?
The idea is to align each member in an structure on its natural boundaries. See Structure Alignment
MREAL macros - when you need floating point arithmetic while assembling!

mabdelouahab

Quote from: ragdog on January 16, 2016, 06:55:39 AM
I have test it with a little Cpp example to get the sizeof Struct

This return the struct size 40 decimal
  printf("%d\n\n",sizeof(NMHVDISPINFO));
I'm not sure but I think that if the size of the NMHVDISPINFO is 40:
NMHDR   =12
    UINT Mask = 4
    UINT State =4
    ULONG64 Address =8
    SIZE_T NumberOfItem=8
    BYTE Value  ( Align)= 4

12+4+4+8+8+4=40

HVITEM   struct   4
   Mask_      DWORD   ?      
   State      DWORD   ?      
   Address      ULONG64   ?      
   NumberOfItem   QWORD   ?      
   Value      BYTE   ?         
HVITEM   ends

MichaelW

Quote from: ragdog on January 16, 2016, 08:11:33 AM
How i can find ou if a struct already aligned or not?
In Olly?

I don't know about Olly, but you can check the alignment of the structure or its members with this:

    ;---------------------------------------------
    ; This macro returns the maximum alignment of
    ; _ptr, or zero for a null pointer.
    ;---------------------------------------------
   
    alignment MACRO _ptr
        push ecx
        xor eax, eax
        mov ecx, _ptr
        bsf ecx, ecx
        jz @F
        mov eax, 1
        shl eax, cl
      @@:
        pop ecx
        EXITM <eax>
    ENDM
Well Microsoft, here's another nice mess you've gotten us into.

guga

The size is 40


00000000 _NMHVDISPINFO   struc ; (sizeof=0x28, standard type)
00000000 NmHdr           tagNMHDR ?
0000000C                 db ? ; undefined
0000000D                 db ? ; undefined
0000000E                 db ? ; undefined
0000000F                 db ? ; undefined
00000010 Item            _HVITEM ?
00000028 _NMHVDISPINFO   ends



00000000 _HVITEM         struc ; (sizeof=0x18, standard type)
00000000 Mask            dd ?
00000004 State           dd ?
00000008 Address         dq ?
00000010 NumberOfItem    dd ?
00000014 Value           db ?
00000015 _padding        db 3 dup(?)
00000018 _HVITEM         ends
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

ragdog

Thank you all

Yes Guga or  mabdelouahab the struct size is 40
My first test by translate a cpp struct is to make a little cpp project and look with printf and sizeof.

And Qwords soulution to add the alignment by 8 works fine.

@Guga how have you make this Dump of structurs?

@MIchael
Thank you i try it.



guga

I compiled the file that uses this https://code.msdn.microsoft.com/HexView-Control-fa70df05

...and opened it in IdaPro. (It was late to do it by hand. I was a bit tired, so i did the fast way ;)

On Ida there is a option to see the structures loaded with the file (When it contains a pdb or dbg, specially)

Btw..this little app (hexview) looks nice :)
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

ragdog

Ahh ok but i have no Ida

Yes look nice and works very good
a Other good option is RadHex control.