1.30 Structures

In C/C++, a structure (struct) is a group of variables packed together in one block, sitting next to each other in memory. These variables can be of different types (int, char, float, and so on). The struct gives a name to this bundle, and gives a name to each field so we can access it.

1.30.1 MSVC: SYSTEMTIME example

The author starts by taking the Win32 SYSTEMTIME structure, which describes time.

Listing 1.329: WinBase.h

1
typedef struct _SYSTEMTIME {
2
    WORD wYear;          // year (e.g. 2026)
3
    WORD wMonth;         // month (1–12)
4
    WORD wDayOfWeek;     // day of week (0=Sunday, 6=Saturday)
5
    WORD wDay;           // day of month (1–31)
6
    WORD wHour;          // hour (0–23)
7
    WORD wMinute;        // minute (0–59)
8
    WORD wSecond;        // second (0–59)
9
    WORD wMilliseconds;  // milliseconds (0–999)
10
} SYSTEMTIME, *PSYSTEMTIME;

Let's write a C function to get the current time:

1
#include <windows.h>
2
#include <stdio.h>
3

4
void main()
5
{
6
    SYSTEMTIME t;              // declare a SYSTEMTIME struct on the stack (16 bytes)
7
    GetSystemTime(&t);         // fill the struct with current UTC time
8
    printf("%04d-%02d-%02d %02d:%02d:%02d\n",
9
           t.wYear, t.wMonth, t.wDay,
10
           t.wHour, t.wMinute, t.wSecond);
11
    return;
12
}

We get (MSVC 2010):

Listing 1.330: MSVC 2010 /GS-

1
_t$ = -16      ; size = 16 bytes ; SYSTEMTIME struct lives here on the stack
2
_main PROC
3
    push    ebp
4
    mov     ebp, esp
5
    sub     esp, 16                         ; reserve 16 bytes on stack for the struct (8 WORDs × 2 bytes)
6

7
    lea     eax, DWORD PTR _t$[ebp]         ; EAX = address of the struct (pointer to wYear = pointer to whole struct)
8
    push    eax                             ; push pointer as argument to GetSystemTime
9
    call    DWORD PTR __imp__GetSystemTime@4 ; call GetSystemTime(&t) — fills all 8 fields
10

11
    movzx   ecx, WORD PTR _t$[ebp+12]      ; load wSecond (offset 12 from struct start)
12
    push    ecx                             ; push as 7th argument to printf
13
    movzx   edx, WORD PTR _t$[ebp+10]      ; load wMinute (offset 10)
14
    push    edx                             ; push as 6th argument
15
    movzx   eax, WORD PTR _t$[ebp+8]       ; load wHour (offset 8)
16
    push    eax                             ; push as 5th argument
17
    movzx   ecx, WORD PTR _t$[ebp+6]       ; load wDay (offset 6)
18
    push    ecx                             ; push as 4th argument
19
    movzx   edx, WORD PTR _t$[ebp+2]       ; load wMonth (offset 2)
20
    push    edx                             ; push as 3rd argument
21
    movzx   eax, WORD PTR _t$[ebp]         ; load wYear (offset 0 — start of struct)
22
    push    eax                             ; push as 2nd argument
23
    push    OFFSET $SG78811                 ; push format string as 1st argument
24
    call    _printf                         ; call printf(format, year, month, day, hour, min, sec)
25
    add     esp, 28                         ; clean up stack (7 arguments × 4 bytes)
26
    xor     eax, eax                        ; return 0
27
    mov     esp, ebp
28
    pop     ebp
29
    ret     0
30
_main ENDP

Let me explain this step by step to make it as clear as possible.

As we said, the fields are stored in the order you declare them. Each field takes space according to its type. In our example:

* WORD = 2 bytes (16 bits)

* 8 fields × 2 bytes = 16 bytes total

Field layout in memory (offsets from the start of the struct):

Field	Offset (bytes)
`wYear`	0
`wMonth`	2
`wDayOfWeek`	4
`wDay`	6
`wHour`	8
`wMinute`	10
`wSecond`	12
`wMilliseconds`	14

The struct begins with the field wYear. We can say that a pointer to the SYSTEMTIME struct is passed to GetSystemTime(), but we could equally say that a pointer to the field wYear is passed — it is the same thing. GetSystemTime() writes the current year into the WORD pointer it receives, then advances 2 bytes forward, writes the current month, and so on.

x32dbg

Let's compile this example in MSVC with the options /GS- /MD and run it in x32dbg using this command:

1
cl /Od /Zi /GS- systemtime.c

Let's open the data and stack view at the address being passed as the first argument to GetSystemTime(), and wait until it executes. We see this:

The system time at the moment of execution on my machine is July 9, 2026, 20:59:51.

Listing 1.331: printf() output

And these are the values currently in memory:

Hex	Decimal	Field
`0x07EA`	2026	`wYear`
`0x0007`	7	`wMonth`
`0x0004`	4	`wDayOfWeek`
`0x0009`	9	`wDay`
`0x0014`	20	`wHour`
`0x002F`	47	`wMinute`
`0x0035`	53	`wSecond`
`0x0209`	521	`wMilliseconds`

The same values appear in the stack window, but grouped as 32-bit values. Then printf() simply takes the values it needs and prints them to the screen. Some values are not printed by printf() (such as wDayOfWeek and wMilliseconds), but they are sitting in memory right now, available for use.

Replacing the structure with array

The author pointed out that the fact that struct fields are simply variables sitting next to each other can be easily demonstrated by doing the following. Keeping the definition of SYSTEMTIME in mind, we can rewrite the simple example like this:

1
#include <windows.h>
2
#include <stdio.h>
3

4
void main()
5
{
6
    WORD array[8];          // plain array of 8 WORDs — same memory layout as SYSTEMTIME
7
    GetSystemTime(array);   // pass array as if it were a SYSTEMTIME pointer
8
    printf("%04d-%02d-%02d %02d:%02d:%02d\n",
9
           array[0] /* wYear */,  array[1] /* wMonth */, array[3] /* wDay */,
10
           array[4] /* wHour */,  array[5] /* wMinute */, array[6] /* wSecond */);
11
    return;
12
}

The compiler only issues a warning — just a reminder that you are doing something that is not type-safe:

1
systemtime2.c(7) : warning C4133: 'function' : incompatible types - from 'WORD [8]' to 'LPSYSTEMTIME'

But it still generates this code:

Listing 1.332: Non-optimizing MSVC 2010

1
$SG78573 DB '%04d-%02d-%02d %02d:%02d:%02d', 0aH, 00H  ; format string
2

3
_array$ = -16      ; size = 16 bytes ; the array lives here on the stack
4
_main PROC
5
    push    ebp
6
    mov     ebp, esp
7
    sub     esp, 16                         ; allocate 16 bytes for the array (same as the struct)
8

9
    lea     eax, DWORD PTR _array$[ebp]     ; EAX = base address of the array
10
    push    eax                             ; pass as argument to GetSystemTime
11
    call    DWORD PTR __imp__GetSystemTime@4 ; GetSystemTime fills array[0..7] with time fields
12

13
    movzx   ecx, WORD PTR _array$[ebp+12]  ; array[6] = wSecond (offset 12)
14
    push    ecx
15
    movzx   edx, WORD PTR _array$[ebp+10]  ; array[5] = wMinute (offset 10)
16
    push    edx
17
    movzx   eax, WORD PTR _array$[ebp+8]   ; array[4] = wHour (offset 8)
18
    push    eax
19
    movzx   ecx, WORD PTR _array$[ebp+6]   ; array[3] = wDay (offset 6)
20
    push    ecx
21
    movzx   edx, WORD PTR _array$[ebp+2]   ; array[1] = wMonth (offset 2)
22
    push    edx
23
    movzx   eax, WORD PTR _array$[ebp]     ; array[0] = wYear (offset 0)
24
    push    eax
25
    push    OFFSET $SG78573                 ; format string
26
    call    _printf
27
    add     esp, 28                         ; clean up stack
28
    xor     eax, eax
29
    mov     esp, ebp
30
    pop     ebp
31
    ret     0
32
_main ENDP

It does exactly the same work. In this code specifically, one cannot say with certainty whether a struct was defined or an array — they look identical at the assembly level.

This is also a reminder that a struct can be changed or replaced by developers over time, and the assembly output would still look the same.

1.30.2 Let's allocate space for a structure using malloc()

Sometimes it is easier to place structures not on the local stack, but on the heap.

Let's first quickly explain what the heap is.

The Heap is a region in a program's memory used for Dynamic Memory Allocation. That means when you need to reserve space in memory at runtime and you don't know its size until that moment, you use the Heap.

1
#include <windows.h>
2
#include <stdio.h>
3

4
void main()
5
{
6
    SYSTEMTIME *t;
7
    t = (SYSTEMTIME *)malloc(sizeof(SYSTEMTIME)); // allocate a SYSTEMTIME-sized block on the heap
8
    GetSystemTime(t);                             // fill the struct with current system time
9
    printf("%04d-%02d-%02d %02d:%02d:%02d\n",
10
           t->wYear, t->wMonth, t->wDay,
11
           t->wHour, t->wMinute, t->wSecond);    // print the time fields
12
    free(t);                                      // release the heap memory
13
    return;
14
}

Let's compile it now with optimization (/Ox) so it's easier to see what we need.

Listing 1.333: Optimizing MSVC

1
_main PROC
2
    push esi                                        ; save old ESI value to restore later
3
    push 16                                         ; push 16 onto the stack as argument to malloc
4
    call _malloc                                    ; call malloc(16)
5
    add esp, 4                                      ; adjust the stack after the call (remove the argument)
6
    mov esi, eax                                    ; ESI = address of the new block (return value from malloc)
7
    push esi                                        ; push the address as argument to GetSystemTime
8
    call DWORD PTR __imp__GetSystemTime@4           ; call GetSystemTime(esi)
9
    ; now ESI holds the address of the struct filled with data
10
    movzx eax, WORD PTR [esi+12]                   ; read wSecond (offset 12) and zero-extend to 32 bits
11
    movzx ecx, WORD PTR [esi+10]                   ; read wMinute (offset 10)
12
    movzx edx, WORD PTR [esi+8]                    ; read wHour (offset 8)
13
    push eax                                        ; push wSecond
14
    movzx eax, WORD PTR [esi+6]                    ; read wDay (offset 6)
15
    push ecx                                        ; push wMinute
16
    movzx ecx, WORD PTR [esi+2]                    ; read wMonth (offset 2)
17
    push edx                                        ; push wHour
18
    movzx edx, WORD PTR [esi]                      ; read wYear (offset 0)
19
    push eax                                        ; push wDay
20
    push ecx                                        ; push wMonth
21
    push edx                                        ; push wYear
22
    push OFFSET $SG78833                           ; push format string pointer
23
    call _printf                                    ; print
24
    push esi                                        ; push address to free
25
    call _free                                      ; release the memory
26
    add esp, 32                                     ; adjust stack after printf and free (all arguments)
27
    xor eax, eax                                    ; eax = 0 (main return value)
28
    pop esi                                         ; restore old ESI
29
    ret 0
30
_main ENDP

Here we find sizeof(SYSTEMTIME) = 16, which is the exact number of bytes that will be allocated by malloc(). As for malloc(), it returns a pointer to the new memory block in register EAX, which then moves to register ESI. The Win32 function GetSystemTime() takes care of preserving the value in ESI.

(A small note about ESI: it is a non-volatile register in the Windows x86 calling convention. This means any function (like malloc, GetSystemTime, or printf) may use and modify it. So if we want to keep a value in it throughout the function, that is why it is not saved here and continues to be used after the GetSystemTime() call.)

There is a new instruction MOVZX (Move with Zero eXtend). It is used in most cases like MOVSX, but it sets the remaining bits to 0. This is because printf() needs a 32-bit int, but we have a WORD in the struct which is an unsigned 16-bit type. That is why when copying the value from a WORD to an int, bits 16 through 31 must be zeroed out, since they might contain random noise left over from previous operations on the registers.

In this example, we can represent the structure as an array of 8 WORDs:

1
#include <windows.h>
2
#include <stdio.h>
3

4
void main()
5
{
6
    WORD *t;
7
    t = (WORD *)malloc(16);                        // allocate 16 bytes on the heap
8
    GetSystemTime(t);                              // fill with system time (treats buffer as SYSTEMTIME)
9
    printf("%04d-%02d-%02d %02d:%02d:%02d\n",
10
           t[0] /* wYear */, t[1] /* wMonth */, t[3] /* wDay */,
11
           t[4] /* wHour */, t[5] /* wMinute */, t[6] /* wSecond */); // access fields by index
12
    free(t);                                       // release the memory
13
    return;
14
}

And this is what it produces:

Listing 1.334: Optimizing MSVC

1
$SG78594 DB '%04d-%02d-%02d %02d:%02d:%02d', 0aH, 00H  ; format string with newline and null terminator
2
_main PROC
3
    push esi
4
    push 16                                         ; push size argument to malloc
5
    call _malloc                                    ; call malloc(16)
6
    add esp, 4                                      ; clean up stack
7
    mov esi, eax                                    ; ESI = pointer to allocated block
8
    push esi                                        ; push pointer as argument to GetSystemTime
9
    call DWORD PTR __imp__GetSystemTime@4           ; call GetSystemTime
10
    movzx eax, WORD PTR [esi+12]                   ; read wSecond (offset 12), zero-extend
11
    movzx ecx, WORD PTR [esi+10]                   ; read wMinute (offset 10), zero-extend
12
    movzx edx, WORD PTR [esi+8]                    ; read wHour (offset 8), zero-extend
13
    push eax                                        ; push wSecond
14
    movzx eax, WORD PTR [esi+6]                    ; read wDay (offset 6), zero-extend
15
    push ecx                                        ; push wMinute
16
    movzx ecx, WORD PTR [esi+2]                    ; read wMonth (offset 2), zero-extend
17
    push edx                                        ; push wHour
18
    movzx edx, WORD PTR [esi]                      ; read wYear (offset 0), zero-extend
19
    push eax                                        ; push wDay
20
    push ecx                                        ; push wMonth
21
    push edx                                        ; push wYear
22
    push OFFSET $SG78594                           ; push format string
23
    call _printf                                    ; call printf
24
    push esi                                        ; push pointer to free
25
    call _free                                      ; free the memory
26
    add esp, 32                                     ; clean up stack (all arguments)
27
    xor eax, eax                                    ; return 0
28
    pop esi                                         ; restore ESI
29
    ret 0
30
_main ENDP

1.30.3 UNIX: struct tm

Let's take the tm struct from the time.h header in Linux as an example:

1
#include <stdio.h>
2
#include <time.h>
3

4
void main()
5
{
6
    struct tm t;         // declare a tm struct on the stack
7
    time_t unix_time;    // variable to hold the current Unix timestamp
8

9
    unix_time = time(NULL);          // get current time as Unix timestamp
10
    localtime_r(&unix_time, &t);     // convert Unix time to local time and fill the struct
11

12
    printf("Year: %d\n", t.tm_year + 1900); // tm_year is years since 1900
13
    printf("Month: %d\n", t.tm_mon);
14
    printf("Day: %d\n", t.tm_mday);
15
    printf("Hour: %d\n", t.tm_hour);
16
    printf("Minutes: %d\n", t.tm_min);
17
    printf("Seconds: %d\n", t.tm_sec);
18
}

Let's compile it in GCC 4.4.1:

Listing 1.335: GCC 4.4.1

1
main proc near
2
    push ebp
3
    mov ebp, esp
4
    and esp, 0FFFFFFF0h                 ; align stack to 16 bytes
5
    sub esp, 40h                        ; allocate local space
6
    mov dword ptr [esp], 0              ; first argument to time() = NULL
7
    call time
8
    mov [esp+3Ch], eax                  ; save the returned Unix timestamp
9
    lea eax, [esp+3Ch]                  ; get pointer to the returned time() value
10
    lea edx, [esp+10h]                  ; struct tm starts at ESP+10h
11
    mov [esp+4], edx                    ; pass pointer to start of struct as 2nd arg
12
    mov [esp], eax                      ; pass pointer to time result as 1st arg
13
    call localtime_r
14
    mov eax, [esp+24h]                  ; load tm_year
15
    lea edx, [eax+76Ch]                 ; edx = eax + 1900 (0x76C = 1900)
16
    mov eax, offset format              ; "Year: %d\n"
17
    mov [esp+4], edx
18
    mov [esp], eax
19
    call printf
20
    mov edx, [esp+20h]                  ; load tm_mon
21
    mov eax, offset aMonthD             ; "Month: %d\n"
22
    mov [esp+4], edx
23
    mov [esp], eax
24
    call printf
25
    mov edx, [esp+1Ch]                  ; load tm_mday
26
    mov eax, offset aDayD               ; "Day: %d\n"
27
    mov [esp+4], edx
28
    mov [esp], eax
29
    call printf
30
    mov edx, [esp+18h]                  ; load tm_hour
31
    mov eax, offset aHourD              ; "Hour: %d\n"
32
    mov [esp+4], edx
33
    mov [esp], eax
34
    call printf
35
    mov edx, [esp+14h]                  ; load tm_min
36
    mov eax, offset aMinutesD           ; "Minutes: %d\n"
37
    mov [esp+4], edx
38
    mov [esp], eax
39
    call printf
40
    mov edx, [esp+10h]                  ; load tm_sec
41
    mov eax, offset aSecondsD           ; "Seconds: %d\n"
42
    mov [esp+4], edx
43
    mov [esp], eax
44
    call printf
45
    leave
46
    retn
47
main endp

Somehow, IDA did not assign names to the local variables on the local stack, but the author said we can figure it out without that information in this simple example.

Also pay attention to the instruction lea edx, [eax+76Ch] — this instruction simply adds 0x76C (1900) to the value in EAX, but without modifying any flags.

GDB

The author started by loading the example in GDB:

1
dennis@ubuntuvm:~/polygon$ date
2
Mon Jun 2 18:10:37 EEST 2014
3

4
dennis@ubuntuvm:~/polygon$ gcc GCC_tm.c -o GCC_tm
5

6
dennis@ubuntuvm:~/polygon$ gdb GCC_tm
7
GNU gdb (GDB) 7.6.1-ubuntu
8
...
9
Reading symbols from /home/dennis/polygon/GCC_tm...(no debugging symbols found)...done.
10

11
(gdb) b printf
12
Breakpoint 1 at 0x8048330
13

14
(gdb) run
15
Starting program: /home/dennis/polygon/GCC_tm
16

17
Breakpoint 1, __printf (format=0x80485c0 "Year: %d\n") at printf.c:29
18
29 printf.c: No such file or directory.
19

20
(gdb) x/20x $esp
21
0xbffff0dc: 0x080484c3 0x080485c0 0x000007de 0x00000000
22
0xbffff0ec: 0x08048301 0x538c93ed 0x00000025 0x0000000a
23
0xbffff0fc: 0x00000012 0x00000002 0x00000005 0x00000072
24
0xbffff10c: 0x00000001 0x00000098 0x00000001 0x00002a30
25
0xbffff11c: 0x0804b090 0x08048530 0x00000000 0x00000000
26
(gdb)

We could easily find our struct on the stack. First, let's see how it is defined in time.h:

Listing 1.337: time.h

1
struct tm
2
{
3
    int tm_sec;   // seconds
4
    int tm_min;   // minutes
5
    int tm_hour;  // hours
6
    int tm_mday;  // day of the month
7
    int tm_mon;   // month
8
    int tm_year;  // year (since 1900)
9
    int tm_wday;  // day of the week
10
    int tm_yday;  // day of the year
11
    int tm_isdst; // daylight saving time flag
12
};

Note that here a 32-bit int is used instead of WORD as in SYSTEMTIME. So each field occupies 32 bits (4 bytes).

1
0xbffff0dc: 0x080484c3 0x080485c0 0x000007de 0x00000000
2
0xbffff0ec: 0x08048301 0x538c93ed 0x00000025 sec 0x0000000a min
3
0xbffff0fc: 0x00000012 hour 0x00000002 mday 0x00000005 mon 0x00000072 year
4
0xbffff10c: 0x00000001 wday 0x00000098 yday 0x00000001 isdst 0x00002a30
5
0xbffff11c: 0x0804b090 0x08048530 0x00000000 0x00000000

Or as a table:

Hex value	Decimal value	Field name
0x00000025	37	tm_sec
0x0000000a	10	tm_min
0x00000012	18	tm_hour
0x00000002	2	tm_mday
0x00000005	5	tm_mon
0x00000072	114	tm_year
0x00000001	1	tm_wday
0x00000098	152	tm_yday
0x00000001	1	tm_isdst

ARM

Optimizing Keil 6/2013 (Thumb mode)

We will use the same example.

Listing 1.338: Optimizing Keil 6/2013 (Thumb mode)

1
var_38 = -0x38
2
var_34 = -0x34
3
var_30 = -0x30
4
var_2C = -0x2C
5
var_28 = -0x28
6
var_24 = -0x24
7
timer = -0xC
8

9
PUSH {LR}                               ; save link register
10
MOVS R0, #0                             ; argument to time() = NULL
11
SUB SP, SP, #0x34                       ; allocate local stack space
12
BL time                                 ; call time(NULL)
13
STR R0, [SP,#0x38+timer]               ; save returned Unix timestamp
14
MOV R1, SP                              ; R1 = pointer to struct tm (tp)
15
ADD R0, SP, #0x38+timer                 ; R0 = pointer to timer variable
16
BL localtime_r                          ; call localtime_r(&timer, tp)
17
LDR R1, =0x76C                          ; R1 = 1900
18
LDR R0, [SP,#0x38+var_24]              ; load tm_year
19
ADDS R1, R0, R1                         ; R1 = tm_year + 1900
20
ADR R0, aYearD                          ; "Year: %d\n"
21
BL __2printf                            ; call printf
22
LDR R1, [SP,#0x38+var_28]              ; load tm_mon
23
ADR R0, aMonthD                         ; "Month: %d\n"
24
BL __2printf                            ; call printf
25
LDR R1, [SP,#0x38+var_2C]              ; load tm_mday
26
ADR R0, aDayD                           ; "Day: %d\n"
27
BL __2printf                            ; call printf
28
LDR R1, [SP,#0x38+var_30]              ; load tm_hour
29
ADR R0, aHourD                          ; "Hour: %d\n"
30
BL __2printf                            ; call printf
31
LDR R1, [SP,#0x38+var_34]              ; load tm_min
32
ADR R0, aMinutesD                       ; "Minutes: %d\n"
33
BL __2printf                            ; call printf
34
LDR R1, [SP,#0x38+var_38]              ; load tm_sec
35
ADR R0, aSecondsD                       ; "Seconds: %d\n"
36
BL __2printf                            ; call printf
37
ADD SP, SP, #0x34                       ; deallocate local stack space
38
POP {PC}                                ; return

Optimizing Xcode 4.6.3 (LLVM) (Thumb-2 mode)

IDA "knows" the tm struct (because IDA "knows" the argument types of library functions like localtime_r()), so it shows here the access to the struct's fields and their names.

Listing 1.339: Optimizing Xcode 4.6.3 (LLVM) (Thumb-2 mode)

1
var_38 = -0x38
2
var_34 = -0x34
3

4
PUSH {R7,LR}                            ; save frame pointer and link register
5
MOV R7, SP                              ; set frame pointer
6
SUB SP, SP, #0x30                       ; allocate local stack space
7
MOVS R0, #0                             ; argument: time_t * = NULL
8
BLX _time                               ; call time(NULL)
9
ADD R1, SP, #0x38+var_34               ; R1 = pointer to struct tm
10
STR R0, [SP,#0x38+var_38]             ; save returned timestamp
11
MOV R0, SP                              ; R0 = pointer to timestamp
12
BLX _localtime_r                        ; call localtime_r
13
LDR R1, [SP,#0x38+var_34.tm_year]     ; load tm_year
14
MOV R0, 0xF44                           ; "Year: %d\n"
15
ADD R0, PC                              ; resolve PC-relative address
16
ADDW R1, R1, #0x76C                    ; R1 = tm_year + 1900
17
BLX _printf                             ; call printf
18
LDR R1, [SP,#0x38+var_34.tm_mon]      ; load tm_mon
19
MOV R0, 0xF3A                           ; "Month: %d\n"
20
ADD R0, PC                              ; resolve address
21
BLX _printf                             ; call printf
22
LDR R1, [SP,#0x38+var_34.tm_mday]     ; load tm_mday
23
MOV R0, 0xF35                           ; "Day: %d\n"
24
ADD R0, PC                              ; resolve address
25
BLX _printf                             ; call printf
26
LDR R1, [SP,#0x38+var_34.tm_hour]     ; load tm_hour
27
MOV R0, 0xF2E                           ; "Hour: %d\n"
28
ADD R0, PC                              ; resolve address
29
BLX _printf                             ; call printf
30
LDR R1, [SP,#0x38+var_34.tm_min]      ; load tm_min
31
MOV R0, 0xF28                           ; "Minutes: %d\n"
32
ADD R0, PC                              ; resolve address
33
BLX _printf                             ; call printf
34
LDR R1, [SP,#0x38+var_34]             ; load tm_sec
35
MOV R0, 0xF25                           ; "Seconds: %d\n"
36
ADD R0, PC                              ; resolve address
37
BLX _printf                             ; call printf
38
ADD SP, SP, #0x30                       ; deallocate stack space
39
POP {R7,PC}                             ; restore frame pointer and return
40
...
41
00000000 tm struc         ; (sizeof=0x2C, standard type)
42
00000000 tm_sec DCD ?     ; seconds field (4 bytes)
43
00000004 tm_min DCD ?     ; minutes field (4 bytes)
44
00000008 tm_hour DCD ?    ; hours field (4 bytes)
45
0000000C tm_mday DCD ?    ; day of month field (4 bytes)
46
00000010 tm_mon DCD ?     ; month field (4 bytes)
47
00000014 tm_year DCD ?    ; year field (4 bytes)
48
00000018 tm_wday DCD ?    ; day of week field (4 bytes)
49
0000001C tm_yday DCD ?    ; day of year field (4 bytes)
50
00000020 tm_isdst DCD ?   ; daylight saving time flag (4 bytes)
51
00000024 tm_gmtoff DCD ?  ; seconds east of UTC (4 bytes)
52
00000028 tm_zone DCD ?    ; timezone abbreviation pointer (offset)
53
0000002C tm ends

MIPS

Listing 1.340: Optimizing GCC 4.4.5 (IDA)

1
main:
2

3
; IDA does not know the struct field names, we named them manually:
4

5
var_40 = -0x40
6
var_38 = -0x38
7
seconds = -0x34
8
minutes = -0x30
9
hour    = -0x2C
10
day     = -0x28
11
month   = -0x24
12
year    = -0x20
13
var_4   = -4
14

15
lui $gp, (__gnu_local_gp >> 16)         ; load upper 16 bits of global pointer
16
addiu $sp, -0x50                        ; allocate 80 bytes on stack
17
la $gp, (__gnu_local_gp & 0xFFFF)       ; load lower 16 bits of global pointer
18
sw $ra, 0x50+var_4($sp)                 ; save return address
19
sw $gp, 0x50+var_40($sp)               ; save global pointer
20
lw $t9, (time & 0xFFFF)($gp)           ; load address of time() from GOT
21
or $at, $zero                           ; load delay slot, NOP
22
jalr $t9                                ; call time(NULL)
23
move $a0, $zero                         ; branch delay slot: pass NULL as argument
24
lw $gp, 0x50+var_40($sp)               ; restore global pointer after call
25
addiu $a0, $sp, 0x50+var_38            ; A0 = pointer to unix_time variable
26
lw $t9, (localtime_r & 0xFFFF)($gp)    ; load address of localtime_r() from GOT
27
addiu $a1, $sp, 0x50+seconds           ; A1 = pointer to start of struct tm (seconds field)
28
jalr $t9                                ; call localtime_r(&unix_time, &struct)
29
sw $v0, 0x50+var_38($sp)               ; branch delay slot: save time() result
30
lw $gp, 0x50+var_40($sp)               ; restore global pointer
31
lw $a1, 0x50+year($sp)                 ; load tm_year
32
lw $t9, (printf & 0xFFFF)($gp)         ; load address of printf from GOT
33
la $a0, $LC0                            ; "Year: %d\n"
34
jalr $t9                                ; call printf
35
addiu $a1, 1900                         ; branch delay slot: add 1900 to year (executes BEFORE jalr returns)
36
lw $gp, 0x50+var_40($sp)               ; restore global pointer
37
lw $a1, 0x50+month($sp)                ; load tm_mon
38
lw $t9, (printf & 0xFFFF)($gp)         ; load address of printf from GOT
39
lui $a0, ($LC1 >> 16)                   ; "Month: %d\n" (upper 16 bits)
40
jalr $t9                                ; call printf
41
la $a0, ($LC1 & 0xFFFF)                ; "Month: %d\n" (lower 16 bits) — branch delay slot
42
lw $gp, 0x50+var_40($sp)               ; restore global pointer
43
lw $a1, 0x50+day($sp)                  ; load tm_mday
44
lw $t9, (printf & 0xFFFF)($gp)         ; load address of printf from GOT
45
lui $a0, ($LC2 >> 16)                   ; "Day: %d\n" (upper 16 bits)
46
jalr $t9                                ; call printf
47
la $a0, ($LC2 & 0xFFFF)                ; "Day: %d\n" (lower 16 bits) — branch delay slot
48
lw $gp, 0x50+var_40($sp)               ; restore global pointer
49
lw $a1, 0x50+hour($sp)                 ; load tm_hour
50
lw $t9, (printf & 0xFFFF)($gp)         ; load address of printf from GOT
51
lui $a0, ($LC3 >> 16)                   ; "Hour: %d\n" (upper 16 bits)
52
jalr $t9                                ; call printf
53
la $a0, ($LC3 & 0xFFFF)                ; "Hour: %d\n" (lower 16 bits) — branch delay slot
54
lw $gp, 0x50+var_40($sp)               ; restore global pointer
55
lw $a1, 0x50+minutes($sp)              ; load tm_min
56
lw $t9, (printf & 0xFFFF)($gp)         ; load address of printf from GOT
57
lui $a0, ($LC4 >> 16)                   ; "Minutes: %d\n" (upper 16 bits)
58
jalr $t9                                ; call printf
59
la $a0, ($LC4 & 0xFFFF)                ; "Minutes: %d\n" (lower 16 bits) — branch delay slot
60
lw $gp, 0x50+var_40($sp)               ; restore global pointer
61
lw $a1, 0x50+seconds($sp)              ; load tm_sec
62
lw $t9, (printf & 0xFFFF)($gp)         ; load address of printf from GOT
63
lui $a0, ($LC5 >> 16)                   ; "Seconds: %d\n" (upper 16 bits)
64
jalr $t9                                ; call printf
65
la $a0, ($LC5 & 0xFFFF)                ; "Seconds: %d\n" (lower 16 bits) — branch delay slot
66
lw $ra, 0x50+var_4($sp)                ; restore return address
67
or $at, $zero                           ; load delay slot, NOP
68
jr $ra                                  ; return
69
addiu $sp, 0x50                         ; delay slot: deallocate stack
70

71
$LC0: .ascii "Year: %d\n"<0>
72
$LC1: .ascii "Month: %d\n"<0>
73
$LC2: .ascii "Day: %d\n"<0>
74
$LC3: .ascii "Hour: %d\n"<0>
75
$LC4: .ascii "Minutes: %d\n"<0>
76
$LC5: .ascii "Seconds: %d\n"<0>

The author said this is an example where branch delay slots can confuse us. For example, there is the instruction addiu $a1, 1900 on line 35 which adds 1900 to the year number. It executes before the corresponding JALR on line 34 — don't forget this detail.

Structure as a set of values

To demonstrate that a struct is simply variables placed next to each other in one place, let's rewrite our example while looking at the tm struct definition one more time:

1
#include <stdio.h>
2
#include <time.h>
3

4
void main()
5
{
6
    // declare all tm fields as individual local variables instead of a struct
7
    int tm_sec, tm_min, tm_hour, tm_mday, tm_mon, tm_year, tm_wday, tm_yday, tm_isdst;
8
    time_t unix_time;
9

10
    unix_time = time(NULL);              // get current Unix timestamp
11
    localtime_r(&unix_time, &tm_sec);   // pass pointer to tm_sec as if it were the start of a struct
12

13
    printf("Year: %d\n", tm_year + 1900);
14
    printf("Month: %d\n", tm_mon);
15
    printf("Day: %d\n", tm_mday);
16
    printf("Hour: %d\n", tm_hour);
17
    printf("Minutes: %d\n", tm_min);
18
    printf("Seconds: %d\n", tm_sec);
19
}

Note: the pointer to the tm_sec field is what gets passed to localtime_r, i.e. to the first element of the "struct".

The compiler warns us:

1
GCC_tm2.c: In function 'main':
2
GCC_tm2.c:11:5: warning: passing argument 2 of 'localtime_r' from incompatible pointer type [enabled by default]
3
In file included from GCC_tm2.c:2:0:
4
/usr/include/time.h:59:12: note: expected 'struct tm *' but argument is of type 'int *'

But despite that, it generates this code:

1
main proc near
2
var_30    = dword ptr -30h
3
var_2C    = dword ptr -2Ch
4
unix_time = dword ptr -1Ch
5
tm_sec    = dword ptr -18h
6
tm_min    = dword ptr -14h
7
tm_hour   = dword ptr -10h
8
tm_mday   = dword ptr -0Ch
9
tm_mon    = dword ptr -8
10
tm_year   = dword ptr -4
11

12
push ebp
13
mov ebp, esp
14
and esp, 0FFFFFFF0h                         ; align stack to 16 bytes
15
sub esp, 30h                                ; allocate local space
16
call __main
17
mov [esp+30h+var_30], 0                    ; arg 0 (NULL) for time()
18
call time
19
mov [esp+30h+unix_time], eax               ; save Unix timestamp
20
lea eax, [esp+30h+tm_sec]                  ; get pointer to tm_sec (start of "struct")
21
mov [esp+30h+var_2C], eax                  ; pass as 2nd arg to localtime_r
22
lea eax, [esp+30h+unix_time]               ; get pointer to unix_time
23
mov [esp+30h+var_30], eax                  ; pass as 1st arg to localtime_r
24
call localtime_r
25
mov eax, [esp+30h+tm_year]                 ; load tm_year
26
add eax, 1900                              ; add 1900
27
mov [esp+30h+var_2C], eax                  ; pass as value to printf
28
mov [esp+30h+var_30], offset aYearD        ; "Year: %d\n"
29
call printf
30
mov eax, [esp+30h+tm_mon]                  ; load tm_mon
31
mov [esp+30h+var_2C], eax
32
mov [esp+30h+var_30], offset aMonthD       ; "Month: %d\n"
33
call printf
34
mov eax, [esp+30h+tm_mday]                 ; load tm_mday
35
mov [esp+30h+var_2C], eax
36
mov [esp+30h+var_30], offset aDayD         ; "Day: %d\n"
37
call printf
38
mov eax, [esp+30h+tm_hour]                 ; load tm_hour
39
mov [esp+30h+var_2C], eax
40
mov [esp+30h+var_30], offset aHourD        ; "Hour: %d\n"
41
call printf
42
mov eax, [esp+30h+tm_min]                  ; load tm_min
43
mov [esp+30h+var_2C], eax
44
mov [esp+30h+var_30], offset aMinutesD     ; "Minutes: %d\n"
45
call printf
46
mov eax, [esp+30h+tm_sec]                  ; load tm_sec
47
mov [esp+30h+var_2C], eax
48
mov [esp+30h+var_30], offset aSecondsD     ; "Seconds: %d\n"
49
call printf
50
leave
51
retn
52
main endp

This code is identical to what we saw before, and we cannot tell whether the original source code had a struct or just a bunch of variables.

And this code works. However, it is not recommended to do this in practice.

Usually, non-optimizing compilers allocate variables on the local stack in the same order they were declared in the function. However, there is no guarantee of this.

By the way, some other compilers might warn about the variables tm_year, tm_mon, tm_mday, tm_hour, tm_min being used without being initialized. Indeed, the compiler does not know that these fields will be filled by the localtime_r() function.

We chose this example because all the struct fields are of type int.

This would not work if the struct fields were 16-bit (WORD), as in the case of the SYSTEMTIME struct — GetSystemTime() would fill them incorrectly (because local variables are aligned on a 32-bit boundary).

So, a struct is simply a bundle of variables existing in one place, next to each other. We can say that a struct is an instruction to the compiler, directing it to keep the variables together in one place. By the way, in some very old versions of C (before 1972), there were no structures at all.

Structure as an array of 32-bit words

1
#include <stdio.h>
2
#include <time.h>
3

4
void main()
5
{
6
    struct tm t;        // declare a tm struct
7
    time_t unix_time;   // Unix timestamp variable
8
    int i;              // loop counter
9

10
    unix_time = time(NULL);          // get current Unix time
11
    localtime_r(&unix_time, &t);     // fill the struct with local time
12

13
    for (i = 0; i < 9; i++)         // iterate over all 9 fields of the struct
14
    {
15
        int tmp = ((int*)&t)[i];     // cast the struct pointer to int* and access field i
16
        printf("0x%08X (%d)\n", tmp, tmp); // print the field value in hex and decimal
17
    }
18
}

This is what came out:

1
0x0000002D (45)
2
0x00000033 (51)
3
0x00000017 (23)
4
0x0000001A (26)
5
0x00000006 (6)
6
0x00000072 (114)
7
0x00000006 (6)
8
0x000000CE (206)
9
0x00000001 (1)

The variables here are in the same order they were declared in the structure definition.

And this is what it looks like after compiling:

1
main proc near
2
    push ebp
3
    mov ebp, esp
4
    push esi
5
    push ebx
6
    and esp, 0FFFFFFF0h             ; align stack to 16 bytes
7
    sub esp, 40h                    ; allocate local stack space
8
    mov dword ptr [esp], 0          ; timer = NULL (argument to time())
9
    lea ebx, [esp+14h]              ; EBX = pointer to start of struct tm
10
    call _time
11
    lea esi, [esp+38h]              ; ESI = pointer to end of struct tm
12
    mov [esp+4], ebx                ; tp (pointer to struct, 2nd arg to localtime_r)
13
    mov [esp+10h], eax              ; save returned Unix timestamp
14
    lea eax, [esp+10h]
15
    mov [esp], eax                  ; timer (1st arg to localtime_r)
16
    call _localtime_r
17
    nop
18
    lea esi, [esi+0]                ; NOP (padding for alignment)
19
loc_80483D8:
20
    ; EBX here is a pointer to the start of the struct,
21
    ; ESI is a pointer to its end.
22
    mov eax, [ebx]                  ; load a 32-bit word from the array
23
    add ebx, 4                      ; advance to the next field in the struct
24
    mov dword ptr [esp+4], offset a0x08xD  ; "0x%08X (%d)\n"
25
    mov dword ptr [esp], 1
26
    mov [esp+0Ch], eax              ; pass value to printf() (decimal)
27
    mov [esp+8], eax                ; pass value to printf() (hex)
28
    call ___printf_chk
29
    cmp ebx, esi                    ; have we reached the end of the struct?
30
    jnz short loc_80483D8           ; no — load the next value
31
    lea esp, [ebp-8]
32
    pop ebx
33
    pop esi
34
    pop ebp
35
    retn
36
main endp

We indeed found that the space on the local stack is treated first as a struct, and then as an array.

It is also possible to modify the struct fields through this pointer. And again, this approach is somewhat hackish and is not recommended for use in production code.

Structure as an array of bytes

We can go even further. Let's cast the pointer to an array of bytes and dump it:

1
#include <stdio.h>
2
#include <time.h>
3

4
void main()
5
{
6
    struct tm t;        // declare a tm struct
7
    time_t unix_time;   // Unix timestamp variable
8
    int i, j;           // loop counters
9

10
    unix_time = time(NULL);          // get current Unix time
11
    localtime_r(&unix_time, &t);     // fill the struct with local time
12

13
    for (i = 0; i < 9; i++)         // iterate over all 9 fields (each 4 bytes)
14
    {
15
        for (j = 0; j < 4; j++)     // iterate over each byte within the field
16
            printf("0x%02X ", ((unsigned char*)&t)[i * 4 + j]); // print byte in hex
17
        printf("\n");                // newline after each field
18
    }
19
}

Output:

1
0x2D 0x00 0x00 0x00
2
0x33 0x00 0x00 0x00
3
0x17 0x00 0x00 0x00
4
0x1A 0x00 0x00 0x00
5
0x06 0x00 0x00 0x00
6
0x72 0x00 0x00 0x00
7
0x06 0x00 0x00 0x00
8
0xCE 0x00 0x00 0x00
9
0x01 0x00 0x00 0x00

The least significant byte comes first, because this is a little-endian architecture.

1
main proc near
2
    push ebp
3
    mov ebp, esp
4
    push edi
5
    push esi
6
    push ebx
7
    and esp, 0FFFFFFF0h             ; align stack to 16 bytes
8
    sub esp, 40h                    ; allocate local stack space
9
    mov dword ptr [esp], 0          ; timer = NULL (argument to time())
10
    lea esi, [esp+14h]              ; ESI = pointer to start of struct tm
11
    call _time
12
    lea edi, [esp+38h]              ; EDI = pointer to end of struct
13
    mov [esp+4], esi                ; tp (pointer to struct, 2nd arg to localtime_r)
14
    mov [esp+10h], eax              ; save returned Unix timestamp
15
    lea eax, [esp+10h]
16
    mov [esp], eax                  ; timer (1st arg to localtime_r)
17
    call _localtime_r
18
    lea esi, [esi+0]                ; NOP (padding for alignment)
19
    ; ESI here is a pointer to the struct on the local stack.
20
    ; EDI is a pointer to the end of the struct.
21
loc_8048408:
22
    xor ebx, ebx                    ; j = 0
23
loc_804840A:
24
    movzx eax, byte ptr [esi+ebx]   ; load a single byte from the struct
25
    add ebx, 1                      ; j = j + 1
26
    mov dword ptr [esp+4], offset a0x02x   ; "0x%02X "
27
    mov dword ptr [esp], 1
28
    mov [esp+8], eax                ; pass the loaded byte to printf()
29
    call ___printf_chk
30
    cmp ebx, 4                      ; have we printed all 4 bytes of this field?
31
    jnz short loc_804840A           ; no — print next byte
32
    ; print a newline character (LF)
33
    mov dword ptr [esp], 0Ah        ; c = '\n'
34
    add esi, 4                      ; advance ESI to the next field (4 bytes)
35
    call _putchar
36
    cmp esi, edi                    ; have we reached the end of the struct?
37
    jnz short loc_8048408           ; no — reset j = 0 and process next field
38
    lea esp, [ebp-0Ch]
39
    pop ebx
40
    pop esi
41
    pop edi
42
    pop ebp
43
    retn
44
main endp

GNU Scientific Library: Representation of complex numbers

The author explains this well here — this is a relatively rare case where an array is used intentionally instead of a struct:

Complex numbers are represented using the type gsl_complex. The internal representation of this type may differ across platforms and must not be accessed directly. The functions and macros described below allow manipulation of complex numbers in a portable way.

For reference, the default format of the gsl_complex type is illustrated by this struct:

1
typedef struct
2
{
3
    double dat[2]; // dat[0] = real part, dat[1] = imaginary part
4
} gsl_complex;

The real part and the imaginary part are stored in adjacent elements of a two-element array. This eliminates any padding between the real and imaginary parts, dat[0] and dat[1], which allows the struct to map correctly onto packed complex arrays.

0xV3n0m