结构体数据的逆向练习

现在可以进行结构体数据还原了~

/// @file exam_1_2.c
/// @brief * 逆向数据到结构

#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
#include <stddef.h>
#include <crtdbg.h>

    /** run result : make data to parse
    vc ide is /Zp8, TAG_PERSON is #pragma pack(4)
    &person = 0x0018FF08
    sizeof(TAG_PERSON) = 0x00000038
    &person end addr is 0x0018FF3F
    ----------------------------------------
    46 CC CC CC 66 66 66 66 66 06 52 40 7A 68 61 6E
    67 73 61 6E 00 CC CC CC CC CC CC CC CC CC CC CC
    CC CC CC CC CC CC CC CC CC CC CC CC DF 07 00 00
    0B 17 CC CC 00 00 2E 43
    ----------------------------------------
    */

#pragma pack(push)
#pragma pack(4)
typedef struct _tag_reverse_struct
{
    char cTmp; ///< 'F'
    double dblTmp; ///< 73.599999999999994, 66 66 66 66 66 66 52 40
    char cMsgBuf[0x20]; ///< zhangsan
    int iTmp1; ///< 2015
    short isTmp; ///< 5899
    float fTmp; ///< 174.000
}TAG_REVERSE_STRUCT;
#pragma pack(pop)

void parse(); ///< 分析数据
void rebuildData(); ///< 重建数据

int main(int argc, char *argv[ ], char *envp[ ])
{
    // parse();
    rebuildData();

    printf("END, press any key to quit\n");
    getchar();
    
    return 0;
}

void rebuildData()
{
    TAG_REVERSE_STRUCT data;

    data.cTmp = 'F';
    data.dblTmp = 73.599999999999994;
    strcpy(data.cMsgBuf, "zhangsan");
    data.iTmp1 = 2015;
    data.isTmp = 5899;
    data.fTmp = 174.000;

    /** 重建之后的结构体数据
    0018FEB8  46 CC CC CC 66 66 66 66 66 66 52 40 7A 68 61 6E  F烫蘤fffffR@zhan
    0018FEC8  67 73 61 6E 00 CC CC CC CC CC CC CC CC CC CC CC  gsan.烫烫烫烫烫.
    0018FED8  CC CC CC CC CC CC CC CC CC CC CC CC DF 07 00 00  烫烫烫烫烫烫....
    0018FEE8  0B 17 CC CC 00 00 2E 43 48 FF 18 00 4D 10 40 00  ..烫...CH...M.@.
    */

    /** run result : make data to parse
    vc ide is /Zp8, TAG_PERSON is #pragma pack(4)
    &person = 0x0018FF08
    sizeof(TAG_PERSON) = 0x00000038
    &person end addr is 0x0018FF3F
    ----------------------------------------
    46 CC CC CC 66 66 66 66 66 06 52 40 7A 68 61 6E
    67 73 61 6E 00 CC CC CC CC CC CC CC CC CC CC CC
    CC CC CC CC CC CC CC CC CC CC CC CC DF 07 00 00
    0B 17 CC CC 00 00 2E 43
    ----------------------------------------
    */

    /// 对比重建前的数据, 完全一致, 说明得到了等价的结构体 ~
    _ASSERT(1); ///< bp
}

void parse()
{
    /// 46 CC CC CC 是一个char
    ///* 	cTmp	70 'F'

    /// 0018FF44  46 CC CC CC 66 66 66 66 66 66 52 40 7A 68 61 6E  F烫蘤fffffR@zhan
    /// 从momory窗口结果区看, 
    /// 66 66 66 66 66 66 52 40 不是float就是double, 
    /// 7A 68 61 6E 是字符串

    /// 先看 66 66 66 66 是不是float, 不像	fTmp	2.72008e+023
    /// * 66 66 66 66 66 66 52 40 是不是double, 像	dblTmp	73.599999999999994
    /// dblTmp

    /**
    /// 先看看下列数据是不是字符串缓冲区, 如果是, 缓冲区长度为0x20
    7A 68 61 6E
    67 73 61 6E 00 CC CC CC CC CC CC CC CC CC CC CC
    CC CC CC CC CC CC CC CC CC CC CC CC 
    */

    /**
    剩下的数据如下
    DF 07 00 00
    0B 17 CC CC 00 00 2E 43

    假定 DF 07 00 00 是int 	, iTmp	2015, 靠谱

    0B 17 是 short int, 	isTmp	5899, 像

    00 00 2E 43 
    不是int, 如果是int的话，这个数太大了,	iTmp	1127088128

    是float, 	fTmp	174.000 像

    */

    int i = 0;

    char cTmp = 0;
    int iTmp = 0;
    short isTmp = 0;
    float fTmp = .0f;
    double dblTmp = 0;
    char cMsgBuf[0x20] = {0x0};
    
    for (i = 0; i < 0x20; i++)
    {
        cMsgBuf[i] = (char)0xCC;
    }

    /**
    观察cMsgBuf, 可以看到数据为一个字符串zhangsan, 那假定cMsgBuf[0x20]
    0018FF10  7A 68 61 6E 67 73 61 6E 00 CC CC CC CC CC CC CC  zhangsan.烫烫烫.
    0018FF20  CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC  烫烫烫烫烫烫烫烫
    */
}

再贴上我***结构体数据的测试程序

/// @file exam_1_1.c
/// @brief * 对结构体的内存窗口, 还原结构内部成员定义和赋值

#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
#include <stddef.h>

// 编译器指定结构对齐值 /Zp8
#pragma pack(push)

/// 结构的实际对齐值 = 用户指定的pack值 和 编译器指定的结构最齐值中最小的为准
#pragma pack(4)

/// 子结构的成员对齐是以最小的成员为准的, 这里最小的成员是 char, 成员对齐值= 1
/// 如果成员是数组, 对齐值以数组成员类型 和 pack(N)之间最小的为准
/// sizeof(子结构)的值是模(pack(N)) == 0的
typedef struct _tag_date_of_birthday
{
    int iYear;
    unsigned char ucMonth;
    unsigned char ucDay;
}TAG_DATE_OF_BIRTHDAY;

typedef struct _tag_person
{
    char cSex;
    double dblweight;
    char szName[30];
    TAG_DATE_OF_BIRTHDAY dob;
    float fHeight;
}TAG_PERSON;

#pragma pack(pop)

int main(int argc, char *argv[ ], char *envp[ ])
{
    int i = 0;
    int iColCnt = 0;
    TAG_PERSON person;

    person.cSex = 'F';
    person.dblweight = 72.1;
    strcpy(person.szName, "zhangsan");
    person.dob.iYear = 2015;
    person.dob.ucMonth = 11;
    person.dob.ucDay = 23;
    person.fHeight = 174.0f;

    printf("vc ide is /Zp8, TAG_PERSON is #pragma pack(4)\r\n");
    printf("&person = 0x%p\n", &person);
    printf("sizeof(TAG_PERSON) = 0x%p\n", sizeof(TAG_PERSON));
    printf("&person end addr is 0x%p\n", (int)&person + sizeof(TAG_PERSON) - 1);

    printf("----------------------------------------\n");
    for (i = 0; i < sizeof(TAG_PERSON); i++)
    {
        if ((0 != iColCnt) && (0 == (iColCnt % 16)))
        {
            printf("\n");
            iColCnt = 0;
        }

        iColCnt++;
        printf("%2.2X ", *((unsigned char*)&person + i));
    }

    printf("\n");
    printf("----------------------------------------\n");

    /** run result : make data to parse
    vc ide is /Zp8, TAG_PERSON is #pragma pack(4)
    &person = 0x0018FF08
    sizeof(TAG_PERSON) = 0x00000038
    &person end addr is 0x0018FF3F
    ----------------------------------------
    46 CC CC CC 66 66 66 66 66 06 52 40 7A 68 61 6E
    67 73 61 6E 00 CC CC CC CC CC CC CC CC CC CC CC
    CC CC CC CC CC CC CC CC CC CC CC CC DF 07 00 00
    0B 17 CC CC 00 00 2E 43
    ----------------------------------------
    */
    
    printf("END, press any key to quit\n");
    getchar();
    
    return 0;
}