ASM to C - Can someone explain me what structure this is?

assembly, c, structure

Solution

If this is really your code, you can make OllyDbg display the corresponding C code by rightclicking into the CPU window, entering the `Comments` submenu and selecting `Show source`. To make that work you'll need the pdb file belonging to the executable.

I'm unsure if Olly1.X does already support that, but the 2.X versions are definitely able to do so.

Problem

I am having the following ASM code (OllyDbg) which should contain a structure developed in c. Can someone tell me how the structure looks like in c programming language? Maybe with a little explanation how you figured out what is stored where in the structure and so on... Thank you very much! ``` CPU Disasm Address Hex dump Command Comments 6A27F058 /$ 68 E9A6286A PUSH 6A28A6E9 ; Entry point 6A27F05D |. 64:FF35 00000 PUSH DWORD PTR FS:[0] 6A27F064 |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 6A27F068 |. 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP 6A27F06C |. 8D6C24 10 LEA EBP,[ESP+10] 6A27F070 |. 2BE0 SUB ESP,EAX 6A27F072 |. 53 PUSH EBX 6A27F073 |. 56 PUSH ESI 6A27F074 |. 57 PUSH EDI 6A27F075 |. A1 E067336A MOV EAX,DWORD PTR DS:[6A3367E0] 6A27F07A |. 3145 FC XOR DWORD PTR SS:[EBP-4],EAX 6A27F07D |. 33C5 XOR EAX,EBP 6A27F07F |. 50 PUSH EAX 6A27F080 |. 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 6A27F083 |. FF75 F8 PUSH DWORD PTR SS:[EBP-8] 6A27F086 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 6A27F089 |. C745 FC FEFFF MOV DWORD PTR SS:[EBP-4],-2 6A27F090 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX 6A27F093 |. 8D45 F0 LEA EAX,[EBP-10] 6A27F096 |. 64:A3 0000000 MOV DWORD PTR FS:[0],EAX 6A27F09C \. C3 RETN ```

Original source