【iOS逆向】结构体类型的数据解析

526 阅读4分钟

结构体可以作为函数的参数或返回值,在逆向竞品的时候,会遇到这个问题,如何直观的获取结构体中的成员变量是一个要解决的问题。

分析流程

  • 1.构建Demo
  • 2.断点调试
  • 3.得出结论
1.构建Demo

本篇采用stat函数

const char *filename = "/Users/tend/Desktop/test_struct/test_struct/111.txt"; //sizeof() = 144
struct stat st;
memset(&st, 0, sizeof(st));
stat(filename, &st);
2.断点调试
(lldb) po sizeof(st)
144

(lldb) memory read &st -c 144
0x7ffeefbff3c8: 04 00 00 01 a4 81 01 00 4c 75 b2 04 03 00 00 00  ........Lu......
0x7ffeefbff3d8: f5 01 00 00 14 00 00 00 00 00 00 00 00 00 00 00  ................
0x7ffeefbff3e8: 4b 63 67 62 00 00 00 00 88 e9 9d 00 00 00 00 00  Kcgb............
0x7ffeefbff3f8: 49 62 67 62 00 00 00 00 00 7d 9f 24 00 00 00 00  Ibgb.....}.$....
0x7ffeefbff408: 4a 63 67 62 00 00 00 00 55 f5 9c 33 00 00 00 00  Jcgb....U..3....
0x7ffeefbff418: 04 08 66 62 00 00 00 00 54 7f a3 36 00 00 00 00  ..fb....T..6....
0x7ffeefbff428: 12 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00  ................
0x7ffeefbff438: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x7ffeefbff448: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
stat成员变量
#define __DARWIN_STRUCT_STAT64_TIMES \
	struct timespec st_atimespec;           /* time of last access */ \ sizeof = 16
	struct timespec st_mtimespec;           /* time of last data modification */ \ sizeof = 16
	struct timespec st_ctimespec;           /* time of last status change */ \ sizeof = 16
	struct timespec st_birthtimespec;       /* time of file creation(birth) */ sizeof = 16
	

#define __DARWIN_STRUCT_STAT64 { \
	dev_t		st_dev;                 /* [XSI] ID of device containing file */ \ sizeof = 4
	mode_t		st_mode;                /* [XSI] Mode of file (see below) */ \ sizeof = 2
	nlink_t		st_nlink;               /* [XSI] Number of hard links */ \  sizeof = 2
	__darwin_ino64_t st_ino;                /* [XSI] File serial number */ \  sizeof = 8
	uid_t		st_uid;                 /* [XSI] User ID of the file */ \ sizeof = 4
	gid_t		st_gid;                 /* [XSI] Group ID of the file */ \ sizeof = 4
	dev_t		st_rdev;                /* [XSI] Device ID */ \ sizeof = 4
	__DARWIN_STRUCT_STAT64_TIMES \ sizeof = 64
	off_t		st_size;                /* [XSI] file size, in bytes */ \ sizeof = 8
	blkcnt_t	st_blocks;              /* [XSI] blocks allocated for file */ \  sizeof = 8
	blksize_t	st_blksize;             /* [XSI] optimal blocksize for I/O */ \  sizeof = 4
	__uint32_t	st_flags;               /* user defined flags for file */ \  sizeof = 4
	__uint32_t	st_gen;                 /* file generation number */ \  sizeof = 4
	__int32_t	st_lspare;              /* RESERVED: DO NOT USE! */ \  sizeof = 4
	__int64_t	st_qspare[2];           /* RESERVED: DO NOT USE! */ \  sizeof = 8
}

通过sizeof对内存进行分割

04 00 00 01 a4 81 01 00 4c 75 b2 04 03 00 00 00
f5 01 00 00 14 00 00 00 00 00 00 00 00 00 00 00

4b 63 67 62 00 00 00 00 88 e9 9d 00 00 00 00 00

49 62 67 62 00 00 00 00 00 7d 9f 24 00 00 00 00

4a 63 67 62 00 00 00 00 55 f5 9c 33 00 00 00 00

04 08 66 62 00 00 00 00 54 7f a3 36 00 00 00 00
12 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00
00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

======获取文件的时间属性========
file name: /Users/tend/Desktop/test_struct/test_struct/111.txt
st_atimespec.tv_sec: 1650942795 hex:6267634B 
st_atimespec.tv_nsec: 10348936 hex:9DE988 
st_mtimespec.tv_sec: 1650942537 hex:62676249 
st_mtimespec.tv_nsec: 614432000 hex:249F7D00 
st_ctimespec.tv_sec: 1650942794 hex:6267634A 
st_ctimespec.tv_nsec: 865924437 hex:339CF555 
st_birthtimespec.tv_sec: 1650853892 hex:62660804 
st_birthtimespec.tv_nsec: 916684628 hex:36A37F54 

st_atimespec:4b 63 67 62 00 00 00 00 88 e9 9d 00 00 00 00 00

st_mtimespec:49 62 67 62 00 00 00 00 00 7d 9f 24 00 00 00 00

st_ctimespec:4a 63 67 62 00 00 00 00 55 f5 9c 33 00 00 00 00

st_birthtimespec:04 08 66 62 00 00 00 00 54 7f a3 36 00 00 00 00

3.得出结论

打印一个结构体,首先要知道他的结构,然后得知道他的sizeof,最后根据各成员变量的类型,找到内存分配,即可打印,注意大小端问题。

4.附件

请联系作者索取