结构体可以作为函数的参数或返回值，在逆向竞品的时候，会遇到这个问题，如何直观的获取结构体中的成员变量是一个要解决的问题。
分析流程
- 1.构建Demo
- 2.断点调试
- 3.得出结论
1.构建Demo
本篇采用stat函数
const char *filename = "/Users/tend/Desktop/test_struct/test_struct/111.txt"; //sizeof() = 144
struct stat st;
memset(&st, 0, sizeof(st));
stat(filename, &st);
2.断点调试
(lldb) po sizeof(st)
144
(lldb) memory read &st -c 144
0x7ffeefbff3c8: 04 00 00 01 a4 81 01 00 4c 75 b2 04 03 00 00 00 ........Lu......
0x7ffeefbff3d8: f5 01 00 00 14 00 00 00 00 00 00 00 00 00 00 00 ................
0x7ffeefbff3e8: 4b 63 67 62 00 00 00 00 88 e9 9d 00 00 00 00 00 Kcgb............
0x7ffeefbff3f8: 49 62 67 62 00 00 00 00 00 7d 9f 24 00 00 00 00 Ibgb.....}.$....
0x7ffeefbff408: 4a 63 67 62 00 00 00 00 55 f5 9c 33 00 00 00 00 Jcgb....U..3....
0x7ffeefbff418: 04 08 66 62 00 00 00 00 54 7f a3 36 00 00 00 00 ..fb....T..6....
0x7ffeefbff428: 12 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ................
0x7ffeefbff438: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x7ffeefbff448: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
stat成员变量
#define __DARWIN_STRUCT_STAT64_TIMES \
struct timespec st_atimespec; /* time of last access */ \ sizeof = 16
struct timespec st_mtimespec; /* time of last data modification */ \ sizeof = 16
struct timespec st_ctimespec; /* time of last status change */ \ sizeof = 16
struct timespec st_birthtimespec; /* time of file creation(birth) */ sizeof = 16
#define __DARWIN_STRUCT_STAT64 { \
dev_t st_dev; /* [XSI] ID of device containing file */ \ sizeof = 4
mode_t st_mode; /* [XSI] Mode of file (see below) */ \ sizeof = 2
nlink_t st_nlink; /* [XSI] Number of hard links */ \ sizeof = 2
__darwin_ino64_t st_ino; /* [XSI] File serial number */ \ sizeof = 8
uid_t st_uid; /* [XSI] User ID of the file */ \ sizeof = 4
gid_t st_gid; /* [XSI] Group ID of the file */ \ sizeof = 4
dev_t st_rdev; /* [XSI] Device ID */ \ sizeof = 4
__DARWIN_STRUCT_STAT64_TIMES \ sizeof = 64
off_t st_size; /* [XSI] file size, in bytes */ \ sizeof = 8
blkcnt_t st_blocks; /* [XSI] blocks allocated for file */ \ sizeof = 8
blksize_t st_blksize; /* [XSI] optimal blocksize for I/O */ \ sizeof = 4
__uint32_t st_flags; /* user defined flags for file */ \ sizeof = 4
__uint32_t st_gen; /* file generation number */ \ sizeof = 4
__int32_t st_lspare; /* RESERVED: DO NOT USE! */ \ sizeof = 4
__int64_t st_qspare[2]; /* RESERVED: DO NOT USE! */ \ sizeof = 8
}
通过sizeof对内存进行分割
04 00 00 01 a4 81 01 00 4c 75 b2 04 03 00 00 00
f5 01 00 00 14 00 00 00 00 00 00 00 00 00 00 00
4b 63 67 62 00 00 00 00 88 e9 9d 00 00 00 00 00
49 62 67 62 00 00 00 00 00 7d 9f 24 00 00 00 00
4a 63 67 62 00 00 00 00 55 f5 9c 33 00 00 00 00
04 08 66 62 00 00 00 00 54 7f a3 36 00 00 00 00
12 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00
00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
======获取文件的时间属性========
file name: /Users/tend/Desktop/test_struct/test_struct/111.txt
st_atimespec.tv_sec: 1650942795 hex:6267634B
st_atimespec.tv_nsec: 10348936 hex:9DE988
st_mtimespec.tv_sec: 1650942537 hex:62676249
st_mtimespec.tv_nsec: 614432000 hex:249F7D00
st_ctimespec.tv_sec: 1650942794 hex:6267634A
st_ctimespec.tv_nsec: 865924437 hex:339CF555
st_birthtimespec.tv_sec: 1650853892 hex:62660804
st_birthtimespec.tv_nsec: 916684628 hex:36A37F54
st_atimespec:4b 63 67 62 00 00 00 00 88 e9 9d 00 00 00 00 00
st_mtimespec:49 62 67 62 00 00 00 00 00 7d 9f 24 00 00 00 00
st_ctimespec:4a 63 67 62 00 00 00 00 55 f5 9c 33 00 00 00 00
st_birthtimespec:04 08 66 62 00 00 00 00 54 7f a3 36 00 00 00 00
3.得出结论
打印一个结构体，首先要知道他的结构，然后得知道他的sizeof，最后根据各成员变量的类型，找到内存分配，即可打印，注意大小端问题。
4.附件
请联系作者索取
