IgniteMe
题目
[FlareOn4]IgniteMe
先查壳，无壳，32程序，拖入IDA
void __noreturn start()
{
DWORD NumberOfBytesWritten; // [esp+0h] [ebp-4h] BYREF
NumberOfBytesWritten = 0;
hFile = GetStdHandle(0xFFFFFFF6);
dword_403074 = GetStdHandle(0xFFFFFFF5);
WriteFile(dword_403074, aG1v3M3T3hFl4g, 0x13u, &NumberOfBytesWritten, 0);
sub_4010F0(NumberOfBytesWritten);
if ( sub_401050() )
WriteFile(dword_403074, aG00dJ0b, 0xAu, &NumberOfBytesWritten, 0);
else
WriteFile(dword_403074, aN0tT00H0tRWe7r, 0x24u, &NumberOfBytesWritten, 0);
ExitProcess(0);
}
- aG1v3M3T3hFl4g ：G1v3 m3 t3h fl4g:
- aG00dJ0b ：G00d j0b!
- aN0tT00H0tRWe7r ：N0t t00 h0t R we? 7ry 4ga1nz plzzz!
关键函数为sub_4010F0和函数sub_401050()
点入sub_4010F0
int sub_4010F0()
{
unsigned int v0; // eax
char Buffer[260]; // [esp+0h] [ebp-110h] BYREF
DWORD NumberOfBytesRead; // [esp+104h] [ebp-Ch] BYREF
unsigned int i; // [esp+108h] [ebp-8h]
char v5; // [esp+10Fh] [ebp-1h]
v5 = 0;
for ( i = 0; i < 0x104; ++i )
Buffer[i] = 0; //Buffer数组0x104(260)全置零
ReadFile(hFile, Buffer, 0x104u, &NumberOfBytesRead, 0); //读入Buffer
for ( i = 0; ; ++i )
{
v0 = sub_401020(Buffer); // sub_401020每次返回Buffer数组中值
if ( i >= v0 )
break;
v5 = Buffer[i]; //赋值v5
if ( v5 != 10 && v5 != 13 ) //v5 != '\n' && v5 != '\r'
{
if ( v5 )
byte_403078[i] = v5; //char byte_403078[264]
}
}
return 1;
}
可以看出该函数主要从输入的字符串中将/r/n去掉，产生char byte_403078[264]数组的值
点入sub_401050()
int sub_401050()
{
int v1; // [esp+0h] [ebp-Ch]
int i; // [esp+4h] [ebp-8h]
unsigned int j; // [esp+4h] [ebp-8h]
char v4; // [esp+Bh] [ebp-1h]
v1 = sub_401020(byte_403078);
v4 = sub_401000(); //右移一位
for ( i = v1 - 1; i >= 0; --i )
{
byte_403180[i] = v4 ^ byte_403078[i];
v4 = byte_403078[i];
}
for ( j = 0; j < 0x27; ++j )
{
if ( byte_403180[j] != (unsigned __int8)byte_403000[j] )
return 0;
}
return 1;
}
返回值为1提示成功，即让byte_403180[j] != (unsigned __int8)byte_403000[j]不成立，点入byte_403000[j]
.data:00403000 ; char byte_403000[40]
.data:00403000 byte_403000 db 0Dh ; DATA XREF: sub_401050+84↑r
.data:00403001 db 26h ; &
.data:00403002 db 49h ; I
.data:00403003 db 45h ; E
.data:00403004 db 2Ah ; *
.data:00403005 db 17h
.data:00403006 db 78h ; x
.data:00403007 db 44h ; D
.data:00403008 db 2Bh ; +
.data:00403009 db 6Ch ; l
.data:0040300A db 5Dh ; ]
.data:0040300B db 5Eh ; ^
.data:0040300C db 45h ; E
.data:0040300D db 12h
.data:0040300E db 2Fh ; /
.data:0040300F db 17h
.data:00403010 db 2Bh ; +
.data:00403011 db 44h ; D
.data:00403012 db 6Fh ; o
.data:00403013 db 6Eh ; n
.data:00403014 db 56h ; V
.data:00403015 db 9
.data:00403016 db 5Fh ; _
.data:00403017 db 45h ; E
.data:00403018 db 47h ; G
.data:00403019 db 73h ; s
.data:0040301A db 26h ; &
.data:0040301B db 0Ah
.data:0040301C db 0Dh
.data:0040301D db 13h
.data:0040301E db 17h
.data:0040301F db 48h ; H
.data:00403020 db 42h ; B
.data:00403021 db 1
.data:00403022 db 40h ; @
.data:00403023 db 4Dh ; M
.data:00403024 db 0Ch
.data:00403025 db 2
.data:00403026 db 69h ; i
.data:00403027 db 0
发现是一个char数组,继续观察sub_401000()
sub_401000 proc near
push ebp
mov ebp, esp
mov eax, 80070057h
mov edx, eax
xor ax, dx
rol eax, 4
shr ax, 1
pop ebp
retn
sub_401000 endp
反编译代码:
_int16 sub_401000()
{
return (unsigned __int16)__ROL4__(-2147024896, 4) >> 1;
}
__ROR4__可以在ida 的plugins的目录下的defs.h头文件里
// rotate left
template<class T> T __ROL__(T value, uint count)
{
const uint nbits = sizeof(T) * 8;
count %= nbits;
T high = value >> (nbits - count);
value <<= count;
value |= high;
return value;
}
2147024896即80070057，应该是将0x80070057,感觉这个函数没看懂
还是分析一下汇编
- 首先将0x80070057赋值给eax,edx(32位程序)，然后ax,dx相当于丢弃了高16位数据
- 然后将dx和ax异或，因为一样，所有ax这时为0
- rol是循环左移(不舍弃)，shr是每位右移, 高位补 0，低位舍弃
- eax为0x80070000h(10000000000001110000000000000000b)
- eax左移4位：00000000011100000000000000001000b
- ax右移1位:0000000000000100b
- 所以可以得到v4的值为100b即4
已经知道所有细节，编写脚本
#-*- codeing = utf-8 -*-
arrary = [0x0D,0x26,0x49,0x45,0x2A,0x17,0x78,0x44,0x2B,0x6C,0x5D,0x5E,0x45,0x12,0x2F,0x17,0x2B,0x44,0x6F,0x6E,0x56,0x09,0x5F,0x45,0x47,0x73,0x26,0x0A,0x0D,0x13,0x17,0x48,0x42,0x01,0x40,0x4D,0x0C,0x02,0x69]
flag = []
v4 = 4
for i in range(len(arrary)-1,-1,-1):
flag.append(arrary[i] ^ v4)
v4 = flag[-1]
print('flag{' + ''.join([chr(x) for x in flag[::-1]]) + '}')
#flag{R_y0u_H0t_3n0ugH_t0_1gn1t3@flare-on.com}
GetStdHandle
检索指定标准设备的句柄（标准输入、标准输出或标准错误）。GetStdHandle 返回的句柄可供需要在控制台中进行读取或写入的应用程序使用。 创建控制台时，标准输入句柄是控制台输入缓冲区的句柄，而标准输出和标准错误句柄则是控制台的活动屏幕缓冲区的句柄。 这些句柄可供 ReadFile 和 WriteFile 函数使用，也可供访问控制台输入缓冲区或屏幕缓冲区的任何控制台函数（例如 ReadConsoleInput、WriteConsole 或 GetConsoleScreenBufferInfo 函数）使用 。
WriteFile 函数 (fileapi.h)
将数据写入指定的文件或输入/输出 (I/O) 设备。
BOOL WriteFile(
HANDLE hFile, //文件或 I/O 设备的句柄
LPCVOID lpBuffer, //指向包含要写入文件或设备的数据的缓冲区的指针
DWORD nNumberOfBytesToWrite, //要写入文件或设备的字节数。
LPDWORD lpNumberOfBytesWritten, //一个指向接收使用同步hFile参数时写入的字节数的变量的指针
LPOVERLAPPED lpOverlapped
);
IDA逆向常用宏定义,IDA的plugins插件目录下"defs.h"中
/*
This file contains definitions used in the Hex-Rays decompiler output.
It has type definitions and convenience macros to make the
output more readable.
Copyright (c) 2007-2020 Hex-Rays
*/
#ifndef HEXRAYS_DEFS_H
#define HEXRAYS_DEFS_H
#if defined(__GNUC__)
typedef long long ll;
typedef unsigned long long ull;
#define __int64 long long
#define __int32 int
#define __int16 short
#define __int8 char
#define MAKELL(num) num ## LL
#define FMT_64 "ll"
#elif defined(_MSC_VER)
typedef __int64 ll;
typedef unsigned __int64 ull;
#define MAKELL(num) num ## i64
#define FMT_64 "I64"
#elif defined (__BORLANDC__)
typedef __int64 ll;
typedef unsigned __int64 ull;
#define MAKELL(num) num ## i64
#define FMT_64 "L"
#else
#error "unknown compiler"
#endif
typedef unsigned int uint;
typedef unsigned char uchar;
typedef unsigned short ushort;
typedef unsigned long ulong;
typedef char int8;
typedef signed char sint8;
typedef unsigned char uint8;
typedef short int16;
typedef signed short sint16;
typedef unsigned short uint16;
typedef int int32;
typedef signed int sint32;
typedef unsigned int uint32;
typedef ll int64;
typedef ll sint64;
typedef ull uint64;
// Partially defined types. They are used when the decompiler does not know
// anything about the type except its size.
#define _BYTE uint8
#define _WORD uint16
#define _DWORD uint32
#define _QWORD uint64
#if !defined(_MSC_VER)
#define _LONGLONG __int128
#endif
// Non-standard boolean types. They are used when the decompiler cannot use
// the standard "bool" type because of the size mistmatch but the possible
// values are only 0 and 1. See also 'BOOL' type below.
typedef int8 _BOOL1;
typedef int16 _BOOL2;
typedef int32 _BOOL4;
typedef int64 _BOOL8;
#ifndef _WINDOWS_
typedef int8 BYTE;
typedef int16 WORD;
typedef int32 DWORD;
typedef int32 LONG;
typedef int BOOL; // uppercase BOOL is usually 4 bytes
#endif
typedef int64 QWORD;
#ifndef __cplusplus
typedef int bool; // we want to use bool in our C programs
#endif
#define __pure // pure function:
// when given the same arguments, always returns the same value
// has no side effects
// Non-returning function
#if defined(__GNUC__)
#define __noreturn __attribute__((noreturn))
#else
#define __noreturn __declspec(noreturn)
#endif
#ifndef NULL
#define NULL 0
#endif
// Some convenience macros to make partial accesses nicer
#define LAST_IND(x,part_type) (sizeof(x)/sizeof(part_type) - 1)
#if defined(__BYTE_ORDER) && __BYTE_ORDER == __BIG_ENDIAN
# define LOW_IND(x,part_type) LAST_IND(x,part_type)
# define HIGH_IND(x,part_type) 0
#else
# define HIGH_IND(x,part_type) LAST_IND(x,part_type)
# define LOW_IND(x,part_type) 0
#endif
// first unsigned macros:
#define BYTEn(x, n) (*((_BYTE*)&(x)+n))
#define WORDn(x, n) (*((_WORD*)&(x)+n))
#define DWORDn(x, n) (*((_DWORD*)&(x)+n))
#define LOBYTE(x) BYTEn(x,LOW_IND(x,_BYTE))
#define LOWORD(x) WORDn(x,LOW_IND(x,_WORD))
#define LODWORD(x) DWORDn(x,LOW_IND(x,_DWORD))
#define HIBYTE(x) BYTEn(x,HIGH_IND(x,_BYTE))
#define HIWORD(x) WORDn(x,HIGH_IND(x,_WORD))
#define HIDWORD(x) DWORDn(x,HIGH_IND(x,_DWORD))
#define BYTE1(x) BYTEn(x, 1) // byte 1 (counting from 0)
#define BYTE2(x) BYTEn(x, 2)
#define BYTE3(x) BYTEn(x, 3)
#define BYTE4(x) BYTEn(x, 4)
#define BYTE5(x) BYTEn(x, 5)
#define BYTE6(x) BYTEn(x, 6)
#define BYTE7(x) BYTEn(x, 7)
#define BYTE8(x) BYTEn(x, 8)
#define BYTE9(x) BYTEn(x, 9)
#define BYTE10(x) BYTEn(x, 10)
#define BYTE11(x) BYTEn(x, 11)
#define BYTE12(x) BYTEn(x, 12)
#define BYTE13(x) BYTEn(x, 13)
#define BYTE14(x) BYTEn(x, 14)
#define BYTE15(x) BYTEn(x, 15)
#define WORD1(x) WORDn(x, 1)
#define WORD2(x) WORDn(x, 2) // third word of the object, unsigned
#define WORD3(x) WORDn(x, 3)
#define WORD4(x) WORDn(x, 4)
#define WORD5(x) WORDn(x, 5)
#define WORD6(x) WORDn(x, 6)
#define WORD7(x) WORDn(x, 7)
// now signed macros (the same but with sign extension)
#define SBYTEn(x, n) (*((int8*)&(x)+n))
#define SWORDn(x, n) (*((int16*)&(x)+n))
#define SDWORDn(x, n) (*((int32*)&(x)+n))
#define SLOBYTE(x) SBYTEn(x,LOW_IND(x,int8))
#define SLOWORD(x) SWORDn(x,LOW_IND(x,int16))
#define SLODWORD(x) SDWORDn(x,LOW_IND(x,int32))
#define SHIBYTE(x) SBYTEn(x,HIGH_IND(x,int8))
#define SHIWORD(x) SWORDn(x,HIGH_IND(x,int16))
#define SHIDWORD(x) SDWORDn(x,HIGH_IND(x,int32))
#define SBYTE1(x) SBYTEn(x, 1)
#define SBYTE2(x) SBYTEn(x, 2)
#define SBYTE3(x) SBYTEn(x, 3)
#define SBYTE4(x) SBYTEn(x, 4)
#define SBYTE5(x) SBYTEn(x, 5)
#define SBYTE6(x) SBYTEn(x, 6)
#define SBYTE7(x) SBYTEn(x, 7)
#define SBYTE8(x) SBYTEn(x, 8)
#define SBYTE9(x) SBYTEn(x, 9)
#define SBYTE10(x) SBYTEn(x, 10)
#define SBYTE11(x) SBYTEn(x, 11)
#define SBYTE12(x) SBYTEn(x, 12)
#define SBYTE13(x) SBYTEn(x, 13)
#define SBYTE14(x) SBYTEn(x, 14)
#define SBYTE15(x) SBYTEn(x, 15)
#define SWORD1(x) SWORDn(x, 1)
#define SWORD2(x) SWORDn(x, 2)
#define SWORD3(x) SWORDn(x, 3)
#define SWORD4(x) SWORDn(x, 4)
#define SWORD5(x) SWORDn(x, 5)
#define SWORD6(x) SWORDn(x, 6)
#define SWORD7(x) SWORDn(x, 7)
// Generate a pair of operands. S stands for 'signed'
#define __SPAIR16__(high, low) (((int16) (high) << 8) | (uint8) (low))
#define __SPAIR32__(high, low) (((int32) (high) << 16) | (uint16)(low))
#define __SPAIR64__(high, low) (((int64) (high) << 32) | (uint32)(low))
#define __SPAIR128__(high, low) (((int128) (high) << 64) | (uint64)(low))
#define __PAIR16__(high, low) (((uint16) (high) << 8) | (uint8) (low))
#define __PAIR32__(high, low) (((uint32) (high) << 16) | (uint16)(low))
#define __PAIR64__(high, low) (((uint64) (high) << 32) | (uint32)(low))
#define __PAIR128__(high, low) (((uint128)(high) << 64) | (uint64)(low))
// Helper functions to represent some assembly instructions.
#ifdef __cplusplus
// compile time assertion
#define __CASSERT_N0__(l) COMPILE_TIME_ASSERT_ ## l
#define __CASSERT_N1__(l) __CASSERT_N0__(l)
#define CASSERT(cnd) typedef char __CASSERT_N1__(__LINE__) [(cnd) ? 1 : -1]
// check that unsigned multiplication does not overflow
template<class T> bool is_mul_ok(T count, T elsize)
{
CASSERT(T(-1) > 0); // make sure T is unsigned
if ( elsize == 0 || count == 0 )
return true;
return count <= T(-1) / elsize;
}
// multiplication that saturates (yields the biggest value) instead of overflowing
// such a construct is useful in "operator new[]"
template<class T> bool saturated_mul(T count, T elsize)
{
return is_mul_ok(count, elsize) ? count * elsize : T(-1);
}
#include <stddef.h> // for size_t
// memcpy() with determined behavoir: it always copies
// from the start to the end of the buffer
// note: it copies byte by byte, so it is not equivalent to, for example, rep movsd
inline void *qmemcpy(void *dst, const void *src, size_t cnt)
{
char *out = (char *)dst;
const char *in = (const char *)src;
while ( cnt > 0 )
{
*out++ = *in++;
--cnt;
}
return dst;
}
// rotate left
template<class T> T __ROL__(T value, int count)
{
const uint nbits = sizeof(T) * 8;
if ( count > 0 )
{
count %= nbits;
T high = value >> (nbits - count);
if ( T(-1) < 0 ) // signed value
high &= ~((T(-1) << count));
value <<= count;
value |= high;
}
else
{
count = -count % nbits;
T low = value << (nbits - count);
value >>= count;
value |= low;
}
return value;
}
inline uint8 __ROL1__(uint8 value, int count) { return __ROL__((uint8)value, count); }
inline uint16 __ROL2__(uint16 value, int count) { return __ROL__((uint16)value, count); }
inline uint32 __ROL4__(uint32 value, int count) { return __ROL__((uint32)value, count); }
inline uint64 __ROL8__(uint64 value, int count) { return __ROL__((uint64)value, count); }
inline uint8 __ROR1__(uint8 value, int count) { return __ROL__((uint8)value, -count); }
inline uint16 __ROR2__(uint16 value, int count) { return __ROL__((uint16)value, -count); }
inline uint32 __ROR4__(uint32 value, int count) { return __ROL__((uint32)value, -count); }
inline uint64 __ROR8__(uint64 value, int count) { return __ROL__((uint64)value, -count); }
// the carry flag of a left shift
template<class T> int8 __MKCSHL__(T value, uint count)
{
const uint nbits = sizeof(T) * 8;
count %= nbits;
return (value >> (nbits-count)) & 1;
}
// the carry flag of a right shift
template<class T> int8 __MKCSHR__(T value, uint count)
{
return (value >> (count-1)) & 1;
}
// sign flag
template<class T> int8 __SETS__(T x)
{
if ( sizeof(T) == 1 )
return int8(x) < 0;
if ( sizeof(T) == 2 )
return int16(x) < 0;
if ( sizeof(T) == 4 )
return int32(x) < 0;
return int64(x) < 0;
}
// overflow flag of subtraction (x-y)
template<class T, class U> int8 __OFSUB__(T x, U y)
{
if ( sizeof(T) < sizeof(U) )
{
U x2 = x;
int8 sx = __SETS__(x2);
return (sx ^ __SETS__(y)) & (sx ^ __SETS__(U(x2-y)));
}
else
{
T y2 = y;
int8 sx = __SETS__(x);
return (sx ^ __SETS__(y2)) & (sx ^ __SETS__(T(x-y2)));
}
}
// overflow flag of addition (x+y)
template<class T, class U> int8 __OFADD__(T x, U y)
{
if ( sizeof(T) < sizeof(U) )
{
U x2 = x;
int8 sx = __SETS__(x2);
return ((1 ^ sx) ^ __SETS__(y)) & (sx ^ __SETS__(U(x2+y)));
}
else
{
T y2 = y;
int8 sx = __SETS__(x);
return ((1 ^ sx) ^ __SETS__(y2)) & (sx ^ __SETS__(T(x+y2)));
}
}
// https://en.wikipedia.org/wiki/Carry_flag#Carry_flag_vs._borrow_flag
#if defined(__ARM__) || defined(__PPC__)
#define SUB_WITH_CARRY 1
#else
#define SUB_WITH_CARRY 0
#endif
// carry flag of subtraction (x-y)
template<class T, class U> int8 __CFSUB__(T x, U y)
{
int size = sizeof(T) > sizeof(U) ? sizeof(T) : sizeof(U);
bool res;
if ( size == 1 )
res = uint8(x) < uint8(y);
else if ( size == 2 )
res = uint16(x) < uint16(y);
else if ( size == 4 )
res = uint32(x) < uint32(y);
else
res = uint64(x) < uint64(y);
#if SUB_WITH_CARRY
res = !res;
#endif
return res;
}
// carry flag of addition (x+y)
template<class T, class U> int8 __CFADD__(T x, U y)
{
int size = sizeof(T) > sizeof(U) ? sizeof(T) : sizeof(U);
if ( size == 1 )
return uint8(x) > uint8(x+y);
if ( size == 2 )
return uint16(x) > uint16(x+y);
if ( size == 4 )
return uint32(x) > uint32(x+y);
return uint64(x) > uint64(x+y);
}
// carry flag of subtraction with carry
template<class T, class U> int8 __CFSUB__(T x, U y, int8 cf)
{
#if SUB_WITH_CARRY
cf = !cf;
#endif
return __CFADD__(y, cf) ^ __CFSUB(x, y + cf);
}
// overflow flag of subtraction with carry
template<class T, class U> int8 __OFSUB__(T x, U y, int8 cf)
{
#if SUB_WITH_CARRY
cf = !cf;
#endif
return __OFADD__(y, cf) ^ __OFSUB(x, y + cf);
}
inline uint8 abs8(int8 x) { return x >= 0 ? x : -x; }
inline uint16 abs16(int16 x) { return x >= 0 ? x : -x; }
inline uint32 abs32(int32 x) { return x >= 0 ? x : -x; }
inline uint64 abs64(int64 x) { return x >= 0 ? x : -x; }
//inline uint128 abs128(int128 x) { return x >= 0 ? x : -x; }
#include <string.h> // for memcpy
#include <type_traits> // for enable_if
template <typename T, typename F>
inline typename std::enable_if<sizeof(T) <= sizeof(F), T>::type __coerce(F f)
{
T t;
memcpy(&t, &f, sizeof(T));
return t;
}
#define COERCE_FLOAT(v) __coerce<float>(v)
#define COERCE_DOUBLE(v) __coerce<double>(v)
#define COERCE_LONG_DOUBLE(v) __coerce<long double>(v)
#define COERCE_UNSIGNED_INT(v) __coerce<unsigned int>(v)
#define COERCE_UNSIGNED_INT64(v) __coerce<uint64>(v)
#else // C++
// For C, we just provide macros, they are not quite correct.
#define __ROL__(x, y) __rotl__(x, y) // Rotate left
#define __ROR__(x, y) __rotr__(x, y) // Rotate right
#define __CFSHL__(x, y) invalid_operation // Generate carry flag for (x<<y)
#define __CFSHR__(x, y) invalid_operation // Generate carry flag for (x>>y)
#define __CFADD__(x, y) invalid_operation // Generate carry flag for (x+y)
#define __CFSUB__(x, y) invalid_operation // Generate carry flag for (x-y)
#define __OFADD__(x, y) invalid_operation // Generate overflow flag for (x+y)
#define __OFSUB__(x, y) invalid_operation // Generate overflow flag for (x-y)
#define abs8(x) (int8) ((int8) (x) >= 0 ? (x) : -(x))
#define abs16(x) (int16) ((int16) (x) >= 0 ? (x) : -(x))
#define abs32(x) (int32) ((int32) (x) >= 0 ? (x) : -(x))
#define abs64(x) (int64) ((int64) (x) >= 0 ? (x) : -(x))
#define abs128(x) (int128)((int128)(x) >= 0 ? (x) : -(x))
#endif // C++
#if defined(__MIPS__)
// traps for MIPS arithmetic operation
void __noreturn __integer_oveflow(void); // SIGFPE/FPE_INTOVF
void __noreturn __divide_by_zero(void); // SIGFPE/FPE_INTDIV
void __noreturn __trap(uint16 trapcode); // SIGTRAP
void __noreturn __break(uint16 code, uint16 subcode);
#endif
// No definition for rcl/rcr because the carry flag is unknown
#define __RCL__(x, y) invalid_operation // Rotate left thru carry
#define __RCR__(x, y) invalid_operation // Rotate right thru carry
#define __MKCRCL__(x, y) invalid_operation // Generate carry flag for a RCL
#define __MKCRCR__(x, y) invalid_operation // Generate carry flag for a RCR
#define __SETP__(x, y) invalid_operation // Generate parity flag for (x-y)
// In the decompilation listing there are some objects declared as _UNKNOWN
// because we could not determine their types. Since the C compiler does not
// accept void item declarations, we replace them by anything of our choice,
// for example a char:
#define _UNKNOWN char
#ifdef _MSC_VER
#define snprintf _snprintf
#define vsnprintf _vsnprintf
#endif
// The ADJ() macro is used for shifted pointers.
// While compilers do not understand it, it makes the code more readable.
// A shifted pointer is declared like this, for example:
// char *__shifted(mystruct,8) p;
// It means: while 'p' points to 'char', it also points to the middle of 'mystruct'.
// More precisely, it is at the offset of 8 bytes from the beginning of 'mystruct'.
//
// The ADJ() macro performs the necessary adjustment.
// The __parentof() and __deltaof() functions are made up, they do not exist.
// __parentof() returns the parent structure type.
// __deltaof() returns the shift amount.
#define ADJ(p) (__parentof(p) *)(p-__deltaof(p))
#endif // HEXRAYS_DEFS_H
浙公网安备 33010602011771号