Get address of a struct

[ragdog]

How i can get all address of an struct give a tool for it?

example

TEB STRUCT
    Tib                            NT_TIB       <>      ; 000h           <<<<<<<<
    EnvironmentPointer             PVOID        ?       ; 01Ch      <<<<
    . . . .
TEB ENDS

[qWord]

?

Code Select Expand

...
.data
    teb TEB <>
.code
    lea eax,teb
    ; or
    lea eax,teb.Tib
    ; or
    lea eax,teb.EnvironmentPointer
...


[redskull]

OFFSET will also work to get the relative positions, as in:

mov eax, OFFSET TEB.EnvironmentPointer

-r

[dedndave]

i think he's asking for the offset relative to the beginning of the structure

Code Select Expand

        mov     eax,offset TEB.EnvironmentPointer-offset TEB
not sure how well that will work, as TEB is a structure definition
OFFSET wants to deal with absolutes

[redskull]

Works fine for me:

Code Select Expand

.386
.model flat, stdcall
option casemap :none   ; case sensitive


FOO STRUCT
    foo1 DWORD 0
    foo2 WORD 0
    foo3 DWORD 0
FOO ENDS

.code

start:

mov eax, OFFSET FOO.foo1
mov eax, OFFSET FOO.foo2
mov eax, OFFSET FOO.foo3


end start

Code Select Expand

00401000 > $ B8 00000000    MOV EAX,0
00401005   . B8 04000000    MOV EAX,4
0040100A   . B8 06000000    MOV EAX,6


[dedndave]

cool Red   :U

[jj2007]

If you continue typing superfluous stuff, you are a candidate for Repetitive Stress Injury

mov eax, FOO.foo2

[redskull]

Eh, I prefer a coding style the emphasizes the difference between a memory bus access and an immediete value.  Besides, I have bigger problems when it comes to risky behaviors for Repetitive Stress Injury    :green2

[jj2007]

Eh, I prefer a coding style the emphasizes the difference between a memory bus access and an immediete value.

That's what I proposed. mov eax, RECT.top is nothing more than an immediate value called DWORD aka 4...
For me, offset means global variable... but I realise this is excellent stuff for a little flame war :bg

[ragdog]

I mean to skip in a value of this structur

example:

mov esi,offset TEB STRUCT
mov eax, [esi+01Ch]

Now is the question to get this address 01Ch  .... of a structur

[jj2007]

I mean to skip in a value of this structur

example:

mov esi,offset TEB STRUCT
mov eax, [esi+01Ch]

Now is the question to get this address 01Ch  .... of a structur

Code Select Expand

mov esi, offset MyRECT
mov eax,  [esi.RECT.right]
lea edx, [esi.RECT.right]
mov ecx, [edx]
.if ecx==eax
  MsgBox "Bingo", "Hi", MB_OK
.endif


[ragdog]

Skip to a structur if not this problem i mean only this address

01Ch
012Fh
..
..
.

mov esi,offset TEB STRUCT
mov eax, [esi+01Ch]

in eax is now EnvironmentPointer

I mean only this hex address to get from a structur

[dedndave]

Red has it right
it is important to understand the difference between a structure type definition and a data definition, though

Code Select Expand

;structure type definition

SomeStruc STRUCT
  Member0 dd ?
  Member1 dd ?
SomeStruc ENDS

        .DATA?

;data definition

ss SomeStruc <>

        .CODE

        mov     eax,offset SomeStruc.Member1   ;4
        mov     eax,offset ss.Member1          ;address of ss+4

you can describe the structure type in the data section which does both, too
this can be the source of some confusion