0
BYTE     b     = 0x12;
WORD     w     = 0x1234;
DWORD    dw    = 0x12345678;
char     str[] = "abcde";

int main(int argc, char *argv[])
{
   byte     lb    = b;
   WORD     lw    = w;
   DWORD    ldw   = dw;
   char     *lstr = str;

   return 0;
}

This is the exe file code I wrote. Put this exe file in ollydbg and find a adress where the lb saved. I think I find a right adress but The order is not as expected

In a dump window, I expected below because it is little endian.

12 00 00 00 | 34 12 00 00 | 78 56 34 12 | 61 62 63 64

But the real is different with what I expected. (Below)

12 00 00 00 | 78 56 34 12 | 34 12 00 00 | 61 62 63 64

Why the lw and ldw are switched?

This is real picture

hy ro
  • 11
  • 1
  • Apparently you didn't find the address of lb but of b (as seen by the str value). As to why the compiler has rearranged variables, I don't know. It doesn't make much sense as it does not exploit possible space savings due to alignment rules. – Hans-Martin Mosner Jul 28 '19 at 08:25
  • Looking at the screenshot, it is clear that you're looking at the static variables (b, w, dw, str) and not at the local variables in your function. But in any case the compiler may place them as it likes, the C language does not require that static variables are arranged in memory in the same order as they appear in your source code. – Hans-Martin Mosner Jul 29 '19 at 08:03

0 Answers0