Pointer training

[tenkey]

Is there no way that I can make the structure point directly to the buffer?

no eax, no nothing -  can I point lpRDBms and lpRDBgui directly at the first byte of rbuffer and use whichever structure I prefer?

This is not a correct view. A structure does not point to anything.

A structure is just a template or layout for a memory area. A structure "variable" is a memory buffer for the structure.

So yes, you can have two pointers pointing to the same buffer. One thing to beware of - accessing the fields of a structure via a pointer requires you to load the pointer into a register. This is a limitation of the processor itself.

Code Select Expand

mov eax,lpRDBms                      ; load pointer (mem address) into a register
mov ecx,[eax].STRUCTNAME.dwordfield  ; get structure field data


Only if the structure buffer is defined in the .DATA section, can you access the fields directly.

Code Select Expand

mov ecx, structbufferlabel.dwordfield ; access .DATA data directly


Just remember -- pointer = address

I don't remember if I've used this before, but you may be able to restructure a .DATA buffer using the chosen STRUCTNAME.

Code Select Expand

mov ecx,structbufferlabel.STRUCTNAME.dwordfield  ; does this work?


[Don]

Hi Edgar, sorry for the delay but I really had to get back to basics - it has been a very long time and I found I have been making a lot of other stupid mistakes -- not just this one :wink

Your original example was what I needed I just remembered doing it in a different way...

mov eax, [REPARSE_GUID_DATA_BUFFER PTR rBuffer].ReparseTag

Thanks again.

Don.