[音乐] [Music]
大家好，欢迎打开分析 hi folks and welcome to open analysis
直播，所以今天我们要谈论逆向工程的基本原理 live so today we're going to talk about reverse engineering fundamental and that
是C ++ druks，了解构造函数以及如何在何时进行分析 is C++ druks and understanding the constructor and how to analyze that when
您打开一个C ++文件并在Ida中进行编译，基本上需要弄清楚 you open up a C++ file and you compile it in Ida need to figure out basically
构造函数如何在程序集中表示以及如何成为结构，以及 how the constructor is represented in assembly and how it becomes a struct and
如何在Ida中使用它，所以希望这不会太无聊，这有点 how that can be used in Ida so hopefully this isn't too boring it's a little bit
更多的理论使性感的逆向工程少了一点，但这是其中之一 more theory a little bit less sexy reverse engineering but it was one of
如果您要真正开始，那么您肯定需要的基础知识 the fundamentals that you'll definitely need if you're gonna start actually
到目前为止，我们的许多教程都对逆向工程有所帮助 reverse engineering stuff a lot of our tutorials so far have been kind of like
分流，但我们已经看到你们提出了很多要求为我们做深潜的请求 triage but we've seen so many requests from you guys to do deep dive for our
senja即将接近教程，所以这是我们要面对的第一个刺 senja nearing tutorials so this is kind of the first stab at that we're gonna
看看这是怎么回事，之所以如此重要，是因为大多数恶意软件 see how that goes so the reason why this is so important is because most malware
我们看到这是本机代码，因此不是dotnet用C ++编译，这是标准 we see that is native code so not dotnet is compiled with C++ it's the standard
如今对于大多数想要本机代码的恶意软件开发人员，您可以 for most malware developers these days who want native code and so you can kind
如果恶意软件很简单，您可以猜测一下支撑是如何 of get by if the malware is simple you can kind of guess at how the struts are
布局，您可以猜测变量的布局，但是如果您来 laid out you can guess at how the variables are laid out but if you come
在即将到来的更复杂的事物中讨论 across something more complex which are going to be talking about in an upcoming
您肯定需要了解本教程的这些基础知识 tutorial you will definitely need to know these sort of basics of how
构造函数的工作方式以及结构的工作方式和Ida以及如何发现它们的设置方法 constructors work and how structs work and Ida and how to spot them how to set
在没有恶意软件进行实际分析之前，它们会像这样 them up stuff like that before you actually analyze a malware without that
知道这将是非常困难的，因为我稍后将向您展示 knowledge it's going to be quite difficult as I will show you in a second
因此，让我们跳到这个，我会告诉你如果你 so with that let's jump into this and I'll show you what you might see if you
在C ++恶意软件中看到了这一点，可能会提示您要处理的问题 see so in C++ malware what might tip you off that you're gonna have to deal with
一些结构，所以如果您看过这个，现在就在这里弹出我们的ID some structs so let's pop over to our ID here now if you ever seen this you know
你有一些C ++恶意软件正在拨号 that you got some c++ malware it's dialing it
所以这是什么他们每次在这里看到他们时，甚至在这里做什么 so what is this what are they even doing here anytime you see this you definitely
知道您将要处理一些strut，也许还有一些C ++，所以 know that you're gonna be dealing with some struts and probably some C++ so
我要做的是退后一步，向大家展示一些消息 what I'll do is I'll take a step back I'm going to show you guys some source
C ++构造函数的代码，这意味着它的外观 code for C++ a constructor what that means how that looks like when it's
编译，然后我们将深入研究此示例，我将向您展示如何设置 compiled and then we'll dive into this example and I'll show you how to set
这使其有意义，所以首先我们需要做的是 this up to make it make sense so first off what we need to do is we need to
谈一谈类以及它们在编译时的外观，以便 talk a little bit about classes and what they look like when you compile them so
这里我们有一个简单的C ++类，它有两个实例变量width和 here we have a simple C++ class and it has two instance variables width and
高度，当您对其进行编译时，类的概念实际上会丢失 height and when you compile it the concept of a class is actually lost it
不再存在，剩下的只有两个变量 doesn't exist anymore and all you're left with our two variables sitting in
就像我在某些情况下所说的那样，足以分析简单 memory somewhere so like I said in some cases this is enough to analyze simple
恶意软件，如果这些变量直接在代码中引用，则不是 malware if those variables are being referenced directly in the code it's not
很大，但是您可以遇到一些非常有趣的场景，例如： a big deal but you can come across some pretty interesting scenarios like this
你有一个神秘的变量，这再次将提示 where you have sort of a mystery variable and this is again what will tip
你离开了，你正在处理一些支柱和一些C ++是当你有 you off that you're dealing with some struts and some C++ is when you have
这些神秘的变量，所以我的意思是这是我们班上的 these mystery variables so what I mean here is here's our class we have a
这里的类的方法，我们将宽度和高度相乘以获得 method for the class here where we multiply the width and the height to get
矩形的面积，我们返回该值，所以您有一个area函数， the area of the rectangle and we return that so you have an area function and
此处的两个实例变量相乘并立即返回 the two instance variables here are multiplied together and returned now
在代码后面的某个地方，您已经实例化了矩形类 somewhere later on your code you've already instantiated the rectangle class
我没有显示出来，您只是要调用该区域函数或区域 I haven't showed that and you're just going to call this area function or area
方法，以便在此处一切正常，但当将其编译为汇编和 method so that all looks fine here but when it gets compiled into assembly and
然后要么尝试对最终的反编译器有所了解 then either tries to make some sense of it doing the decompiler you end up with
像这样疯狂的事情，所以你们可能以前曾经看过 something crazy like this so you guys have probably seen this before if you've
看着C ++，就像我说的大多数本机代码恶意软件C ++不是C，所以您 looked at C++ and like I said most native code malware C++ not C so you
可能已经在拥有函数并将其作为 probably have seen this where you have a function and pass to the function as a
变量一个变量，然后在该函数中，您将有一个 variable a single variable and then inside that function you will have a
该变量发生了很多事情，看起来好像 bunch of stuff happening with that variable and it will look as if that
变量是一个数组，看起来就像您知道在引用该数组一样 variable is an array it'll look as if you know you're referencing that
可以像这样在我们看到的那样可变的人 variable one able to etc etc just like we saw in that
例如，我向您展示了碘，所以在这种情况下，您肯定知道 example I show you in iodine so in that case you definitely know something is
这里不对，发生了什么事，有一个应用的内存对象 not right here and what's happened is there's an applied memory object that is
传递给所有这些调用这些类调用，所以看看这是什么类 passed to all of these calls these class calls so see how this is the class
矩形和方法区域，因此只要您在C ++中看到它，就意味着 rectangle and the method area so anytime you see this in C++ it's implied that
该类的对象内存实际上传递给此函数， the object memory for that class is actually passed into this function which
这就是为什么我们现在看到一个变量传递到函数中的原因 is why we see a variable being passed into the function here now the problem
是Ida和编译器等不知道这实际上是一个结构 is that Ida and the compiler etc don't know that this is actually a struct
它包含所有知道的类变量，它是一个指向 which contains the class variables all it knows is that it's a pointer to
内存，而该指针是结构中的第一个变量，那么它是什么 memory and that pointer is the very first variable in the struct so what it
最终看起来像是在ayat中，看起来像是您只是通过了一个 ends up looking like in ayat is it looks like you're just passing a single
该类的变量，然后一旦进入该类，就可以对其进行编译 variable to the class and then once you get in the class you'd be compile it you
看看它，您会看到所有这些似乎都是来自无处的额外变量 look at it and you see all these extra variables that seem to come from nowhere
他们来自哪里，所以这就是这里发生的一切 where did they come from so that's really what's happening here and it
如果您不了解或不了解，可能会造成混乱 could be really confusing if you don't understand that or if you don't if you
还没有将其定义为结构，所以现在让我们看一下当 haven't defined this as a struct so now let's take a look at what happens when
您告诉Lida这实际上是一个内存结构，应该对其进行处理 you tell Lida that this is actually a memory structure and it should treat it
作为指向结构的指针，而不是指向单个变量的指针，因此我将展示 as a pointer to a struct not a pointer to a single variable so I'm gonna show
您如何操作HIDA，但这里我仅向您展示一个示例 you how to do so HIDA in a second but here I'm just showing you an example
我们在这里完成了两个实例变量的结构定义， where we've done a struct definition of the two instance variables here to int
晚上，我们现在有了这个变量，而不是使用int with the night and we have now instead of using int for this variable we have
定义它为那个结构，所以我们完成了一个破坏定义， defined it as that structure so we've done a destruct definition so what that
告诉我们，只要有指向该内存的指针，就指向 tells is that anytime that there's a pointer to this memory it's a pointer to
整个结构，它不再是仅指向单个变量的指针 the whole struct and it's not a pointer to just a single variable again I'll
在Ida向大家展示一下这只是一个快速概述，因此您可以直观地看到 show you guys this in Ida this is just a quick overview so you can visualize
发生了什么，这对于我们之前的示例来说意味着什么 what's happening so what that means for our example that was confusing before
希望弹出它，所以现在当我们在这里看到对该函数的调用时 hopefully pop over to it so now when we see a call to this function here instead
传递给var的指针的指针，我们有一个指向struct的指针 of a pointer to var with being passed we have a pointer to this which is a struct
我们已经定义了，所以您可以在这里看到它的震撼 that we've defined so you can see here it's a struck
现在定义，只要在该函数中实际使用该结构 define now whenever that struct is actually used in this function it'll be
正确引用Struts中的变量，我将再次向您展示 referencing the variables within the struts correctly and again I'll show you
一秒钟，但这就是这，这基本上就是魔术 that in a second but this is the this is the magic basically you have to sort of
猜测何时进行此操作以及结构大小将是多少 guess when you are going through this and what the struct size is going to be
然后您手动定义它是很费时的，有一些工具 then you manually define it it's kind of time-consuming there's a few tools for
这个，但它们都不是很好，我只是要给你们看 this but none of them really work very well I'm just gonna show you guys the
今天手动操作的方式，因此您手动定义结构 manual way to do it today and so you manually define the struct
然后在找到结构之后，您可以更改变量的类型 then after you to find the struct you change the type of the variable that
指向结构中的第一个变量是那个是 points to the first variable in the struct to be that struct that's a
满嘴，但基本上，您将其称为结构而不是指向a的指针 mouthful but basically you're calling this a struct instead of a pointer to a
变量，然后Ida会注意使用struct的任何地方，好吧， variable and then Ida will note anywhere that struct is used okay well there's a
这里需要引用的所有变量，它将 whole bunch of variables here that needs to be referenced and it will
自动为您取消引用它们，稍后我会再显示给您 automatically dereference them for you which again I'll show you in a second so
如果您不这样做，那是对这里发生的事情的高级概述 that's kind of the high-level overview of what's going on here if you don't
有C ++的背景，而您实际上并不了解类似的对象或 have a background in C++ and you don't really know about like objects or
对你来说很难的课程 classes that's gonna be pretty hard for you
显然，这可能是至少要做一点编码的前提 obviously that's probably a prerequisite to at least do a little bit of coding
如果您要开始进行反向工程恶意软件，并且 yourself probably if you're gonna start actually reverse engineering malware and
不只是做一些我们在这个频道上展示过的分类文章 not just doing sort of the triage stuff that we've been showing on this channel
您肯定需要至少了解C ++的一些基础知识 you're definitely gonna need to know at least some of the fundamentals of C++
就像我说的大多数恶意软件C ++（如果尚未完成） like I said most malware C++ if it's not done yet
因此，让我们在这里举一个例子，我将向您展示 so with that being said let's pop into an example here and I'll show you what
它看起来像从编译版本到简单的Ida版本，没有 it looks like from the compiled version to the simple Ida version with no
结构，然后如何识别支柱并将其添加 structs and then how to identify the struts and add them there's a couple
的技巧并不像看起来那么难，我会提供一些快捷方式 tricks there it's not as hard as it looks there's a few shortcuts that I'll
向您展示这肯定会有所帮助，所以让我们跳到我们的虚拟机 show you that will definitely help out with this so let's pop over to our VM
好的，这是一个简单的示例，所以我们有一个类矩形，我们有两个 here okay so here's a simple example so we have a class rectangle we have two
类变量或实例变量width和height，我们有函数或 class variables or instance variables width and height and we have function or
一种称为设置值的方法，如果您在此处向下看，我们将要使用 a method called set values where we are going to if you look down here we're
实际为这两个变量赋值，因此我们将设置x和y going to actually assign values to the two variables so we'll set the x and y
矩形的坐标，然后我们有 coordinates of the rectangle and then we have
称为area的函数或称为area的方法，其中我们返回宽度乘以 function called area or a method called area where we return the width times the
高度并在这种情况下使用实例变量，因此我们没有传递 height and using the instance variables in this case so we're not passing
任何参数，但就像我刚刚向大家展示的那样， anything any parameters but like I just showed you guys there's an implied
假设您将在编译后将内存对象传递给此处 assumption that you're gonna pass the memory object here once it's compiled so
在这里，我们主要要做的是将值设置为x down here in our main what are we going to do we're going to set the values to x
等于3 y等于4，我们将其打印出来，然后将其称为 equals 3 y equals 4 we're going to print that out then we are going to call the
区域函数或区域方法，我们也将其打印出来 area function or the area method and we're going to print that out too so
这种涵盖了我所谈论的我们的一个非常简单的例子 this kind of covers a very simple example of what I was talking about we
有一个带有一堆实例变量的类，这是众所周知的 have a class with a bunch of instance variables here it's all well understood
您正在使用此功能设置实例变量的情况， what's happening your instance variables are being set with this function and
然后将它们与该功能配合使用，但是您会看到我们何时 then they're being used with this function however you'll see when we
编译这个，我们来看一个Ida，一开始看起来很疯狂 compile this and we take a look at an Ida things look pretty crazy at first
好的，所以当我们在Ida中打开它时，它们全部被编译了，我们看到一个打开的主窗口 okay so it's all compiled up when we open it up in Ida we see an open main
在这里，我们要跳转到此功能，现在我要去做的是 here we have a jump into this function here now what I'm gonna do is I'm going
使用Ida的十六进制D编译器是付费产品 to use the hex raise D compiler for Ida it's a paid product
不幸的是，我们尝试使用Ida反汇编程序来完成所有分类教程 unfortunately we try and do all of our triage tutorials with Ida disassembler
它是免费提供的，但可用于任何反向工程， which is available for free but for anything reverse engineering where
您实际上是在对恶意软件进行真正的反向工程 you're actually doing real reverse engineering in the malware I would say
这不是不可能，但是如果没有编译器的话真的很难做 it's it's not impossible but it's really really hard to do without be compiler
这基本上是很慢的，因为您必须重建所有 it's very slow is basically what it is because you have to reconstruct all of
该程序集的C流程，现在花了很长时间，指导编写 the C flow from this assembly and it just takes a long time now guide write
或者就像我只称其为GG Hydra那样，它具有D编译器 or as I like to call it just just GG Hydra it has the D compiler in it for
您第一次问世时，我们曾考虑过使用G Hydra做一些教程 you when it first came out we thought about doing some tutorials with G Hydra
或家伙吸引，但这不是我们的事，您知道我认为我们宁愿表现 or guy drew but it's just not our thing you know I think that we'd rather show
你们是我们自己分析事物的方式，而我永远也不会使用地理 you guys how we analyze things ourselves and I'm never going to use geography so
你知道这取决于你们想要什么，但我死了 you know it's up to you guys what you want but I'm dead
我们没有使用它，所以我不会假装我会使用它 we're not using it so I'm not gonna make it to toriel pretending that I would use
所以我们确实使用了X射线反编译器，所以让我们f5弹出它，然后 it so we do use the x-rays decompiler so let's f5 it pop over into it and
我们将看到我们到达这里，所以这就是我在说的 we'll see what we got here so here's what I'm talking about we have
所以您可以在这里看到的SIA这是我们正在打印的打印声明 the so you can see here the SIA this is the print statement where we're printing
我们将矩形设置为X＆Y X 3 y 4，然后是 what we have set the rectangle to be so that's the X&Y X 3 y 4 and then here is
我们在该区域打印该区域，您可以看到我们正在将变量传递给 where we print the area and you can see that we're passing a variable to the
这里的区域来自此功能，因此仅基于源 area here which is coming from this function so just based on the source
代码并了解我们对此的了解，我认为这是获取区域 code and knowing what we know about this I would assume that this is the get area
而且很明显，我们看到3和4的地方就是设置 and that this obviously where we see the 3 and the 4 is where we're setting the
现在当然值，如果您进行反向工程，您将不会知道 values now of course if you're reverse engineering this you wouldn't know that
所以我只是带您了解如何做到这一点 so I'll just sort of take you through a blind perspective of how to do this
没有真正从源代码知道所以我要做的第一件事 without actually knowing from the source code so the first thing I'm gonna do
这是我要弹出的函数，看看它的作用，所以我们弹出 here is I'm gonna just pop into this function see what it does so we pop in
如果我们在这里弹出，它看起来就像是另一个函数的包装 here it looks like it's just a wrapper for another function if we pop in here
在这里，我们开始看到一些有趣的东西，以便我们可以再次看到 here's where we start to see some interesting stuff so we can see again
就像我在一开始向你们展示的那样，这是一个数组，而你 like I was showing you guys at the beginning this is an array and you are
将值分配给下一个数组，这样就可以立即使用 assigning values to the next array so this is right off the bat you know
这里有问题，有些地方不正确 something's wrong here something's something's not right
因此，如果我们返回，我们可以看到Ida已为此修复了类型定义，因此 so if we go back we can see that Ida has fixed the type definition for this so
他们实际上已经为此功能，所以他们实际上添加了一个额外的参数 they've actually for this function so they've actually added an extra argument
如果我们回到这里回到主功能，您会看到 and if we pop back here to the to the main function here you can see that
他们已经自动添加了这些额外的东西，他们意识到需要 they've added this extra automatically they've realized that there needs to be
函数中的一个额外参数，如果您是反向的，这是一个快速提示 an extra argument here in the function that's a quick tip if you're reverse
工程Ida并不总是知道何时进行拆卸， engineering Ida it doesn't always know when it's doing its disassembly and it's
D编译正确数量的参数，如果您打开 a D compilation the right number of arguments and if you just open up the
功能，如果您向下钻取，通常会弄清楚 functions if you drill down drill down it will usually sort of figure out that
如果有一个缺少的论点，那么您可以看到那是他们的观点 there was a missing argument if there is one so you can see that's what they've
在这里，他们添加了一个，就像我之前对C ++和对象所说的， done here they've added one and like I said before with C++ and objects you are
总是将第一个参数传递给函数将是 always going to have the first argument passed to the function is going to be a
指向该类的内存对象的指针，所以这就是您所有实例的位置 pointer to the memory object of that class so that's where all your instance
变量将被存储，这就是我们现在在这里看到的 variables are going to be stored so that's what we see here now
在这一点上，我们真的不知道这是C ++，还是不确定您是否知道 at this point we don't really know that this is C++ or we're not sure you know
显然，您可以检查编译器类型和类似的东西，但是让我们说 obviously you could check the compiler types and stuff like that but let's say
我们不太确定，所以只要您看到任何东西，我都会说这是您的第一个提示 we're not too sure so I would say here's your first tip anytime you see something
它通过引用传递变量，所以他们正在做的是 where it's passing a variable by reference so what they're doing is are
接受这个V 5自变量V 5，然后他们传递指向该地址的地址 taking this V 5 argument V 5 and they're passing the address that points to that
可以自动提示您该功能的功能 to a function that should automatically tip you off that this is something
这是通过引用而不是通过值传递的，所以他们要做的是 that's being passed by reference not by value and so they're going to be doing
在函数中对该变量进行一些工作，只要您将其视为 some work on that variable inside the function and anytime you see it as the
传递给我的第一个变量告诉我，这是 first variable that's being passed to a class to me that kind of tells me that's
那可能是一个类的实例对象，通常 that's probably gonna be the instance object for a class that's that's usually
您在这里看到的内容再一次在第二个功能中看到它用完了 what you see here and again you see it used down here in the second function
这种提示，您可以看到它现在将被使用几次 this kind of tips you off you can see it's going to be used a couple times now
在此功能上提示您，您可能想弄清楚发生了什么 on the function this tips you off you probably want to figure out what's going
在继续进行反向工程之前使用此变量 with this variable before you keep reverse-engineering
因为您可能会遇到这样的情况：您所知道的事情看起来真的很奇怪 because you might end up in a scenario where things you know really look weird
让我们来看看这个功能，我会告诉你我的意思是您弹出 so let's take a look at this function and I'll show you what I mean you pop in
这个功能是这个功能的包装器 to this function it's a wrapper popping to this function
在这里，我们有一个奇怪的场景，所以您没有真正的方法 and here here we have the weird scenario right so there's no real way for you to
弄清楚到底发生了什么，直到弄清楚这是什么 figure out what the heck is going on here until you figure out what this is
因此，让我们回到此处，我们将尝试找出所有设置方法，以便 so let's pop back here and we'll try and figure out how this is all set up so the
最好的方法是找到引用该变量的第一个地方 best way to do this is find the first place where that variable is referenced
在函数中，然后深入研究它，看看它实际在哪里 in the function and then drill into it and see where it's actually being
操作，所以我的意思是将值分配给它 operated on so what I mean is where values are being assigned to it with
具有大型内存对象的大型结构，有时会在分配时看到 large structs with large memory objects you will see sometimes on allocate
他们为我们分配了一堆空间的功能，就像 function where they allocate a bunch of space for it for us that's like the
最佳情况，因为在这种情况下我们将确切知道它有多大 best-case scenario because then we'll know exactly how big it is in this case
我不认为发生这种情况是因为它很小，所以我们可以 I don't think that happens because it's kind of small so we can just kind of
再次在这里钻进它只是一个包装，让我们在这里看看，这样我们就可以看到 drill in here again it's just a wrapper and let's take a look here so we can see
实际上已经分配了一些东西，所以我们现在可以做的就是依靠 there's actually stuff being assigned to it so what we can do now is we can rely
在艾达（Ida）上为我们做出一些决定时，我有时觉得这有点冒险 on Ida to make some decisions for us this is kind of risky sometimes I think
这是错误的，但是速度很快，而且是帮助您快速入门的捷径 it's wrong but it's fast and it's a shortcut that'll get you started at
至少，我们要做的是右键单击并重置指针类型 least so what we do is we right-click and we reset the pointer type
所以我们告诉它不是B字，将其重置为默认值，然后我们要做的是 so we tell it it's not a B word reset it back to default then what we do is we
右键单击它，我们说创建一个新的结构类型，您可以在这里看到 right-click on it and we say create a new struct type and you can see here
Ida确定如果这实际上是指向内存中的结构的指针 that Ida has determined that if this is actually a pointer to a struct in memory
他们会有两个D字z'，他们之所以知道这是因为 it's gonna have two D word z' and the reason why they know that is because
他们看了这里使用的偏移量，加上四个。 they looked at the offset that's being used here and it's plus four so they see
实际上有一个整数被分配给第一个入口点 that there's an integer actually being assigned to it to the first entry point
进入那个内存，然后四个字节后，他们分配另一个整数 into that memory and then four bytes later they're assigning another integer
所以又有四个字节的单词，所以他们说的是可能有两个D so another four byte word so what they're saying is there's probably two D
内存结构中的单词，所以我们可以接受这个意思是我们什么都不知道 words in this memory structure so we can take this I mean we don't know any
更好，所以在这一点上，让我们假设这就是我们要说的 better so at this point so let's just assume that that's what it is let's say
好吧，听起来不错，他们会 okay that sounds good and that they'll
自动将此变量转换为结构，因此您现在可以在此处看到 automatically cast this variable as a struct and so you can see here now
将会引用该结构，这更有意义 there'd be referencing the struct and this makes a lot more sense
因此，他们基本上是将arg2分配给struct和 so they're basically assigning arg2 to the first view word in the struct and
arg3到第二个D字和struct，所以这已经使它多了一点 arg3 to the second D word and the struct so this already makes a little bit more
感觉，但您会看到我们何时返回，我们将继续以此定义事物 sense but you'll see when we go back and we continue to define things with this
这里的结构只是复制它，我们可以看到事情会变得一点点 structure here just copy it we can see that things are gonna make a little bit
更有意义，让我们回到这里，您可以看到现在必须将其定义为 more sense so let's pop back here you can see this now has to be defined as a
结构，所以我们要做的是因为您可以在这里看到它是一个结构 structure so what we do is because you can see here it's a structure here so
我们可以在这里执行的操作是，只需单击功能，然后按Y键即可重新定义 what we can do here is we just click on the function press Y to redefine the
类型，然后我们将该变量的定义更改为 type and then we're going to change the definition of this variable to be that
结构，并且像我说的那样通过引用传递，所以他们传递了一个指针 structure and it's passed by reference like I said so they're passing a pointer
到它在内存中的位置，所以我们需要那里的小星号 to where it exists in memory so we need that little asterisk there to let it
知道它是通过引用传递的，所以说好吧，然后我们可以弹出 know that it's passed by reference so let's say okay and then we can pop back
进一步，现在将要定义它，所以您可以在这里看到它的 further and now this is going to be defined so you can see right here it's
将被定义为此结构，所以现在这变得更加有意义 going to be defined as struct to this so now this makes a whole lot more sense
这个函数现在在这里使用这个结构，所以让我们进入这个 this structure is now being used here in this function so let's go into this
功能，看看我们是否可以看到这里发生了什么，所以我们想要的第一件事 function and see if we can see what's going on here so the first thing we want
我们要做的是重新定义函数定义，将鼠标悬停在它上面 to do is we want to redefine the function definitions so hover over it
按Y，我们将更改参数，因为再次知道 press Y and we're going to change the argument because again we know the
参数是一个结构，因此我们将参数更改为此结构 argument is a structure so we're going to change the argument to this struct
再一次，您可以在这里看到安培沙，因此它被参考传递 and again you can see the amp sand here so it's passed by a reference
我们将其更改为星号，然后一旦弹出 we're going to change this to an asterisks okay and then once we pop into
您可以看到它实际上是直接传递给此函数的 this you can see that this is actually passed directly into this function it's
只是一个跳跃，所以我们将重新定义它以及结构，然后 just a jump so we're going to redefine this as well as a structure and then
当我们跳到这里看时，这更有意义，所以我们可以看到 when we jump in here look at that this makes way more sense so we can see
这实际上是第一个或第二个D字乘以第一个D that this is in fact the first or the second D word multiplied by the first D
那个结构中的单词，他们正在接受它的结果，所以再次 word in that structure and they're taking the result of it so again that's
与该区域相同，所以让我们回到这里的初始功能，我们将看到 the same as the area so let's go back to our initial function here and we'll see
如果我们不知道这是怎么回事 if we can't figure out what's going on here
所以我们可以看到这里的打印语句是矩形3乘以4乘以x乘以y so we can see the print statement here is rectangle 3 times 4 so x times y so
让我们重命名类型，将arg1更改为X并更改 let's rename the type here will change this arg1 to our X and we'll change this
第二个为什么？好的，然后我们将其弹出，我想我们要命名 second one to argh why ok and then we'll pop into it and I think we're gonna name
它作为矩形设置XY好，实际上就像我说的 it as rectangles set X Y okay and that's actually just like I said
它只是该课程的包装，所以我们将再次更改此名称， it's just a wrapper for this class so we're gonna change this name again and
我们将其称为环绕矩形集1 XY，这是真正的说唱 we're gonna call it a wrap rectangle set 1 X Y and this is the real rap this is
真正的一个，所以我们要重命名该矩形集XY，所以这只是一个 the real one so we're gonna rename this rectangle set X Y so this is just a
命名约定，您不必这样做，这只是我的方式 naming convention you don't have to do this this is just the way that I
通常这样做是因为如果您有一个函数，它的唯一目的是调用另一个函数 normally do it so if you have a function and it's only purpose is to call another
函数我要么在它前面放一个J，这就是Ida的意思 function I'll either put a J in front of it which is what Ida does which means
像跳到它上面，或者我只是说唱在它前面，让自己知道 like a jump to it or I'll just put rap in front of it to let myself know that
它包装了另一个函数，所以这意味着我可以为此设置类型 it wraps this other function so that means that I can set the type for this
该函数的类型定义，所以我们知道这是Arg X，因为我们 the type definition for this function so we know that this is Arg X because we
可以在这里看到，然后第二个就可以了 can see it in the we can see right here and then this second one is argh Y all
对，然后跳进去，所以我们拥有了所有这些 right and then jump into it and so we have all this
现在很有意义，所以您知道X在这里，让我们重命名，这是很酷的部分 makes sense now so you know X is here so let's rename and this is the cool part
在这里，让我们在结构中重命名该第一个变量，以便在您按n时 here so let's rename this first variable in the struct so when you press n on
在这里您可以将其重命名并命名为X ok，然后将第二个重命名 here you can rename it and let's name it X ok and then let's rename the second
这里一个按n命名Y好的，所以我们现在可以知道我们正在设置x和y one here press n name it Y ok so we can we know now that we're setting x and y
变量或矩形的类实例的变量，因此 variables for the memory or for the class instantiation of rectangle so
让我们在这里弹出我们的主要功能，然后将此栏重命名为 let's pop back to our main function here and rename this bar this so this the the
这个词在面向对象的程序设计中经常用到 word this is often used in object-oriented programming to mean the
用于实例化类的内存对象或用于实例化对象的实例化对象 memory object for the instantiation of a class or the instantiation object of a
类，这通常意味着什么，这就是为什么它只是一个 class that's what this usually means that's why it's just that it's just a
命名约定在Ida中实际上并不意味着有什么特别之处，但我 naming convention it doesn't actually mean anything special in Ida but I'm
只是重命名它，这样我们才知道它到底是什么，所以让我们 just renaming it far this so that we know what exactly what it is so let's
在这里弹出我们的其他功能，再看看它在做什么，这是一个 pop into our other function here and see what it's doing so again this is a
这个函数的包装器，所以当我们命名这个时，我们要命名这个 wrapper for this function so when we name this one we're gonna name this one
包装让我们进入其中，然后将变量重命名为内存 wrap let's pop into it and now that renaming of the variables for the memory
对象显然已在此处传播，因此结构名称跟随变量 object has obviously propagated in here so the struct names follow the variable
无论走到哪里，我们现在都可以确切看到正在发生的情况 wherever it goes so we can see now exactly what's happening this is y times
X，他们正在返回结果，所以这显然是好的区域。 X and they're returning the results so this is obviously name good area right
在那里，我们非常简单，无需定义该结构并重命名 there we go wow so pretty simple without defining that structure and renaming the
再次在结构内部变量，这真的不会太有意义 variables inside the structure again this really wouldn't made too much sense
但是通过重命名进一步发展他们现在所处的位置，这使得 but by renaming it furthering out what they are now this makes a whole bunch of
感觉我们可以继续进行Burress工程，如果我们弹出 sense we can kind of get on with our Burress engineering and if we pop back
我们知道，这就是我们的名字，这只是获得区域的跳跃 we know that this is just if we name it this is just a jump to get area so like
我说我真的知道这只是一个跳转，所以他们把一个JI I said I'd actually know this this is just a jump to it so they put a J I like
使用wrap而不是J，但这只是我个人的喜好，所以我们 to use wrap instead of J but it's just my own personal preference so then we
可以看到这实际上是括号区域，我们可以阅读 can see that this is actually bracket areas and we can read
这是我们的区域，然后我们知道我们正在打印该区域，因此 this is of our area and then we know that we were printing out the area so
简而言之，这就是您的操作方式 there you go in a nutshell that's how you do it
如果要实际编辑，我还有最后一件事要告诉您 there is one last thing that I want to show you if you want to actually edit
您使用Ida自动创建的这些支撑架，您可以进入视图 these struts that you've created with Ida automatically you can go into view
子视图本地类型，您的结构就在这里，您可以右键单击 sub view local types and your structure is right here and you can right click
编辑它，然后您会得到一个不错的C样式编辑窗口，因此这很漂亮 Edit it and then you get a nice C style editing window for it so this is pretty
很酷，如果您对某些恶意软件进行反向工程，这就是您知道的编辑方式 cool this is how you you know edit it if you are reverse engineering some malware
并且您将保持反向并共享它的不同版本 and you're gonna keep reverse and sharing different versions of it it's
始终将这些支撑保持在周围，以便将来使用 always nice to keep these struts around so you can apply them for future
可能会弹出该结构的其他位置的恶意软件版本 versions of the malware the other place where you might see this struct pop up
在这些Struts视图中，因此，如果您进入子视图Struts，则可以看到 is in these struts view so if you go into view subviews struts you can see
就在这里，这种观点的唯一问题是它不是我 it's right here the only problem with this view is that it is a I'm not really
确定如何说这就像结构的内存表示，所以如果您 sure how to say this it's like a memory representation of the struct so if you
要编辑它，您必须在需要扩展的地方做一些愚蠢的事情 want to edit it you have to sort of do this silly thing where you like expand
结构类型或您喜欢的添加，您知道可以添加到它或任何咖啡中 the struct type or you like add you know you can add to it or whatever coffee it
等等，这有点笨拙，所以我实际上想使用 etc and it's kind of clunky so what I like to do is I actually like to use the
局部类型，它为您提供了我向您展示的C定义，然后 local types which gives you that C definition that I've showed you and then
这样，您很容易知道，如果有结构，就很容易进行操作 that way it's easy to you know it's easy to manipulate it if you have structs
您已经导入并且它们不在本地类型中，则可以随时将它们添加到 that you've imported and they're not in local types you can always add them to
局部类型（如果仅存在于Struck的观点中），这没什么大不了的 local types if they only exist in the Struck's view it's not a big deal I
再次，我总是更喜欢将它们导入为本地类型，然后以这种方式使用 again I always prefer to import them as local types and then use them that way
好吧，总之有结构和构造函数，我希望这不是 okay so there's structs and constructors in a nutshell I hope this has been not
太无聊了，但是就像我说的那样，这是我们挖掘之前的必备要素之一 too boring but like I say it is one of those sort of essentials before we dig
即将进行一些更复杂的逆向工程 into a little more complex reverse-engineering coming soon is going
成为一个教程，我在加密货币上还有一个类似的快速提示教程 to be a tutorial I have one more quick tip tutorial like this on some crypto
然后我们将做一个关于为老鼠构建配置提取器的教程 and then we're going to do a tutorial on building a config extractor for a rat
但同样，您必须先了解C ++基础结构的构造函数和结构 but again you have to understand the C++ basics constructors and structs before
我们开始讨论，直到下一次继续揭露1美元背后的机制 we get into that so until next time keep exposing the mechanics behind a dollar
保持好奇 stay curious
您 you