Is it possible to manually pad a struct in order to isololate the variable you want to read/write to? [closed]

Question

. 。 This question needs details or clarity . It is not currently accepting answers.

---

Add details and clarify the problem by editing this post .

Closed 4 hours ago .

Improve this question

For example if I have the following struct located in ah file and I need to access (read) the variable Alerted . How would I manually pad this struct so that I am able to access this variable?

struct _MYSTRUCT
{
    struct _DISPATCHER_HEADER Header;                              
    VOID* SListFaultAddress;                                        
    ULONGLONG QuantumTarget;                                        
    VOID* InitialStack;                                             
    VOID* volatile StackLimit;                                      
    VOID* StackBase;                                                
    ULONGLONG ThreadLock;                                           
    volatile ULONGLONG CycleTime;                                   
    ULONG CurrentRunTime;                                           
    ULONG ExpectedRunTime;                                          
    VOID* KernelStack;                                                
    struct _XSAVE_FORMAT* StateSaveArea;                     
    struct _KSCHEDULING_GROUP* volatile SchedulingGroup;     
    union _KWAIT_STATUS_REGISTER WaitRegister;               
    volatile UCHAR Running;                                  
    UCHAR Alerted[2];                                        
}

EDIT: I need to be able to access variables belonging to the _KTHREAD struct and I cannot find any documentation for this struct on Microsoft website. Please this project of mine is just for fun not going into production code of any sort.

Answer 1

It is not clear why you can't use object->alerted directly, but it seems that you want to access alerted without specifying the name of the member, in this case you can use offsetof , an example:

#include <stdio.h>
#include <stddef.h>

struct T
{
    int a, b, c;
    unsigned char alerted[2];
};

static size_t offset = offsetof(struct T, alerted);

void func(void *object)
{
    printf("%c%c\n",
        ((unsigned char *)object + offset)[0],
        ((unsigned char *)object + offset)[1]
    );
}

int main(void)
{
    struct T t = {1, 2, 3, "ab"};

    func(&t);
    return 0;
}

Output:

ab