While reading “Reversing – Secrets of reverse engineering” I came across this piece of code:
UnknownStruct->Member1 = 0;
UnknownStruct->Member3 = &UnknownStruct->Member2;
UnknownStruct->Member2 = &UnknownStruct->Member2;
UnknownStruct->Member4 = &UnknownStruct->Member2;
which comes from the following asm lines:
7C921A3E MOV EAX,DWORD PTR SS:[EBP+8]
7C921A41 XOR EDX,EDX
7C921A43 LEA ECX,DWORD PTR DS:[EAX+4]
7C921A46 MOV DWORD PTR DS:[EAX],EDX
7C921A48 MOV DWORD PTR DS:[ECX+4],ECX
7C921A4B MOV DWORD PTR DS:[ECX],ECX
7C921A4D MOV DWORD PTR DS:[EAX+C],ECX
The author states:
The […] three members are initialized in a somewhat unusual fashion: They are all being initialized to point to the address of the second member. What could that possibly mean? Essentially it tells you that each of these members is a pointer to a group of three pointers (because that’s what pointed to by UnknownStruct->Member2—a group of three pointers).
I am confused as to how UnknownStruct->Member2 is a group of three pointers – how should this snippet be looked at to deduce that or is this a mistake?
With each of the members pointing to &UnknownStruct->Member2, which is a single address, how does it suddenly turn into a 3-pointer group?
11
There is nothing of substance here. This is just the author’s own language, as there is nothing technical in C or assembly language that is a “group,” nor is it a word commonly used in computer science or software engineering that would have any particular relevance here.
Reverse engineering commonly involves attempting to divine the intention of the author of code. To this end, somebody engaging in reverse engineering may form hypotheses about the code author’s intentions and construct narratives that help them understand those intentions. The textbook author’s use of the word “group” may be part of this.
If there is any meaning to be found in why the author used the word “group,” it is in the surrounding or prerequisite text of the book.