[Music] [音乐]大家好，欢迎打开分析
[Music] 直播，所以今天我们要谈论逆向工程的基本原理
[Music] hi folks and welcome to open analysis 是C ++ druks，了解构造函数以及如何在何时进行分析
hi folks and welcome to open analysis 您打开一个C ++文件并在Ida中进行编译，基本上需要弄清楚
hi folks and welcome to open analysis live so today we're going to talk about 构造函数如何在程序集中表示以及如何成为结构，以及
live so today we're going to talk about 如何在Ida中使用它，所以希望这不会太无聊，这有点
live so today we're going to talk about reverse engineering fundamental and that 更多的理论使性感的逆向工程少了一点，但这是其中之一
reverse engineering fundamental and that 如果您要真正开始，那么您肯定需要的基础知识
reverse engineering fundamental and that is C++ druks and understanding the 到目前为止，我们的许多教程都对逆向工程有所帮助
is C++ druks and understanding the 分流，但我们已经看到你们提出了很多要求为我们做深潜的请求
is C++ druks and understanding the constructor and how to analyze that when senja即将接近教程，所以这是我们要面对的第一个刺
constructor and how to analyze that when 看看这是怎么回事，之所以如此重要，是因为大多数恶意软件
constructor and how to analyze that when you open up a C++ file and you compile 我们看到这是本机代码，因此不是dotnet用C ++编译，这是标准
you open up a C++ file and you compile 如今对于大多数想要本机代码的恶意软件开发人员，您可以
you open up a C++ file and you compile it in Ida need to figure out basically 如果恶意软件很简单，您可以猜测一下支撑是如何
it in Ida need to figure out basically 布局，您可以猜测变量的布局，但是如果您来
it in Ida need to figure out basically how the constructor is represented in 在即将到来的更复杂的事物中讨论
how the constructor is represented in 您肯定需要了解本教程的这些基础知识
how the constructor is represented in assembly and how it becomes a struct and 构造函数的工作方式以及结构的工作方式和Ida以及如何发现它们的设置方法
assembly and how it becomes a struct and 在没有恶意软件进行实际分析之前，它们会像这样
assembly and how it becomes a struct and how that can be used in Ida so hopefully 知道这将是非常困难的，因为我稍后将向您展示
how that can be used in Ida so hopefully 因此，让我们跳到这个，我会告诉你如果你
how that can be used in Ida so hopefully this isn't too boring it's a little bit 在C ++恶意软件中看到了这一点，可能会提示您要处理的问题
this isn't too boring it's a little bit 一些结构，所以如果您看过这个，现在就在这里弹出我们的ID
this isn't too boring it's a little bit more theory a little bit less sexy 你有一些C ++恶意软件正在拨号
more theory a little bit less sexy 所以这是什么他们每次在这里看到他们时，甚至在这里做什么
more theory a little bit less sexy reverse engineering but it was one of 知道您将要处理一些strut，也许还有一些C ++，所以
reverse engineering but it was one of 我要做的是退后一步，向大家展示一些消息
reverse engineering but it was one of the fundamentals that you'll definitely C ++构造函数的代码，这意味着它的外观
the fundamentals that you'll definitely 编译，然后我们将深入研究此示例，我将向您展示如何设置
the fundamentals that you'll definitely need if you're gonna start actually 这使其有意义，所以首先我们需要做的是
need if you're gonna start actually 谈一谈类以及它们在编译时的外观，以便
need if you're gonna start actually reverse engineering stuff a lot of our 这里我们有一个简单的C ++类，它有两个实例变量width和
reverse engineering stuff a lot of our 高度，当您对其进行编译时，类的概念实际上会丢失
reverse engineering stuff a lot of our tutorials so far have been kind of like 不再存在，剩下的只有两个变量
tutorials so far have been kind of like 就像我在某些情况下所说的那样，足以分析简单
tutorials so far have been kind of like triage but we've seen so many requests 恶意软件，如果这些变量直接在代码中引用，则不是
triage but we've seen so many requests 很大，但是您可以遇到一些非常有趣的场景，例如：
triage but we've seen so many requests from you guys to do deep dive for our 你有一个神秘的变量，这再次将提示
from you guys to do deep dive for our 你离开了，你正在处理一些支柱和一些C ++是当你有
from you guys to do deep dive for our senja nearing tutorials so this is kind 这些神秘的变量，所以我的意思是这是我们班上的
senja nearing tutorials so this is kind 这里的类的方法，我们将宽度和高度相乘以获得
senja nearing tutorials so this is kind of the first stab at that we're gonna 矩形的面积，我们返回该值，所以您有一个area函数，
of the first stab at that we're gonna 此处的两个实例变量相乘并立即返回
of the first stab at that we're gonna see how that goes so the reason why this 在代码后面的某个地方，您已经实例化了矩形类
see how that goes so the reason why this 我没有显示出来，您只是要调用该区域函数或区域
see how that goes so the reason why this is so important is because most malware 方法，以便在此处一切正常，但当将其编译为汇编和
is so important is because most malware 然后要么尝试对最终的反编译器有所了解
is so important is because most malware we see that is native code so not dotnet 像这样疯狂的事情，所以你们可能以前曾经看过
we see that is native code so not dotnet 看着C ++，就像我说的大多数本机代码恶意软件C ++不是C，所以您
we see that is native code so not dotnet is compiled with C++ it's the standard 可能已经在拥有函数并将其作为
is compiled with C++ it's the standard 变量一个变量，然后在该函数中，您将有一个
is compiled with C++ it's the standard for most malware developers these days 该变量发生了很多事情，看起来好像
for most malware developers these days 变量是一个数组，看起来就像您知道在引用该数组一样
for most malware developers these days who want native code and so you can kind 可以像这样在我们看到的那样可变的人
who want native code and so you can kind 例如，我向您展示了碘，所以在这种情况下，您肯定知道
who want native code and so you can kind of get by if the malware is simple you 这里不对，发生了什么事，有一个应用的内存对象
of get by if the malware is simple you 传递给所有这些调用这些类调用，所以看看这是什么类
of get by if the malware is simple you can kind of guess at how the struts are 矩形和方法区域，因此只要您在C ++中看到它，就意味着
can kind of guess at how the struts are 该类的对象内存实际上传递给此函数，
can kind of guess at how the struts are laid out you can guess at how the 这就是为什么我们现在看到一个变量传递到函数中的原因
laid out you can guess at how the 是Ida和编译器等不知道这实际上是一个结构
laid out you can guess at how the variables are laid out but if you come 它包含所有知道的类变量，它是一个指向
variables are laid out but if you come 内存，而该指针是结构中的第一个变量，那么它是什么
variables are laid out but if you come across something more complex which are 最终看起来像是在ayat中，看起来像是您只是通过了一个
across something more complex which are 该类的变量，然后一旦进入该类，就可以对其进行编译
across something more complex which are going to be talking about in an upcoming 看看它，您会看到所有这些似乎都是来自无处的额外变量
going to be talking about in an upcoming 他们来自哪里，所以这就是这里发生的一切
going to be talking about in an upcoming tutorial you will definitely need to 如果您不了解或不了解，可能会造成混乱
tutorial you will definitely need to 还没有将其定义为结构，所以现在让我们看一下当
tutorial you will definitely need to know these sort of basics of how 您告诉Lida这实际上是一个内存结构，应该对其进行处理
know these sort of basics of how 作为指向结构的指针，而不是指向单个变量的指针，因此我将展示
know these sort of basics of how constructors work and how structs work 您如何操作HIDA，但这里我仅向您展示一个示例
constructors work and how structs work 我们在这里完成了两个实例变量的结构定义，
constructors work and how structs work and Ida and how to spot them how to set 晚上，我们现在有了这个变量，而不是使用int
and Ida and how to spot them how to set 定义它为那个结构，所以我们完成了一个破坏定义，
and Ida and how to spot them how to set them up stuff like that before you 告诉我们，只要有指向该内存的指针，就指向
them up stuff like that before you 整个结构，它不再是仅指向单个变量的指针
them up stuff like that before you actually analyze a malware without that 在Ida向大家展示一下这只是一个快速概述，因此您可以直观地看到
actually analyze a malware without that 发生了什么，这对于我们之前的示例来说意味着什么
actually analyze a malware without that knowledge it's going to be quite 希望弹出它，所以现在当我们在这里看到对该函数的调用时
knowledge it's going to be quite 传递给var的指针的指针，我们有一个指向struct的指针
knowledge it's going to be quite difficult as I will show you in a second 我们已经定义了，所以您可以在这里看到它的震撼
difficult as I will show you in a second 现在定义，只要在该函数中实际使用该结构
difficult as I will show you in a second so with that let's jump into this and 正确引用Struts中的变量，我将再次向您展示
so with that let's jump into this and 一秒钟，但这就是这，这基本上就是魔术
so with that let's jump into this and I'll show you what you might see if you 猜测何时进行此操作以及结构大小将是多少
I'll show you what you might see if you 然后您手动定义它是很费时的，有一些工具
I'll show you what you might see if you see so in C++ malware what might tip you 这个，但它们都不是很好，我只是要给你们看
see so in C++ malware what might tip you 今天手动操作的方式，因此您手动定义结构
see so in C++ malware what might tip you off that you're gonna have to deal with 然后在找到结构之后，您可以更改变量的类型
off that you're gonna have to deal with 指向结构中的第一个变量是那个是
off that you're gonna have to deal with some structs so let's pop over to our ID 满嘴，但基本上，您将其称为结构而不是指向a的指针
some structs so let's pop over to our ID 变量，然后Ida会注意使用struct的任何地方，好吧，
some structs so let's pop over to our ID here now if you ever seen this you know 这里需要引用的所有变量，它将
here now if you ever seen this you know 自动为您取消引用它们，稍后我会再显示给您
here now if you ever seen this you know that you got some c++ malware it's 如果您不这样做，那是对这里发生的事情的高级概述
that you got some c++ malware it's 有C ++的背景，而您实际上并不了解类似的对象或
that you got some c++ malware it's dialing it 对你来说很难的课程
dialing it 显然，这可能是至少要做一点编码的前提
dialing it so what is this what are they even doing 如果您要开始进行反向工程恶意软件，并且
so what is this what are they even doing 不只是做一些我们在这个频道上展示过的分类文章
so what is this what are they even doing here anytime you see this you definitely 您肯定需要至少了解C ++的一些基础知识
here anytime you see this you definitely 就像我说的大多数恶意软件C ++（如果尚未完成）
here anytime you see this you definitely know that you're gonna be dealing with 因此，让我们在这里举一个例子，我将向您展示
know that you're gonna be dealing with 它看起来像从编译版本到简单的Ida版本，没有
know that you're gonna be dealing with some struts and probably some C++ so 结构，然后如何识别支柱并将其添加
some struts and probably some C++ so 的技巧并不像看起来那么难，我会提供一些快捷方式
some struts and probably some C++ so what I'll do is I'll take a step back 向您展示这肯定会有所帮助，所以让我们跳到我们的虚拟机
what I'll do is I'll take a step back 好的，这是一个简单的示例，所以我们有一个类矩形，我们有两个
what I'll do is I'll take a step back I'm going to show you guys some source 类变量或实例变量width和height，我们有函数或
I'm going to show you guys some source 一种称为设置值的方法，如果您在此处向下看，我们将要使用
I'm going to show you guys some source code for C++ a constructor what that 实际为这两个变量赋值，因此我们将设置x和y
code for C++ a constructor what that 矩形的坐标，然后我们有
code for C++ a constructor what that means how that looks like when it's 称为area的函数或称为area的方法，其中我们返回宽度乘以
means how that looks like when it's 高度并在这种情况下使用实例变量，因此我们没有传递
means how that looks like when it's compiled and then we'll dive into this 任何参数，但就像我刚刚向大家展示的那样，
compiled and then we'll dive into this 假设您将在编译后将内存对象传递给此处
compiled and then we'll dive into this example and I'll show you how to set 在这里，我们主要要做的是将值设置为x
example and I'll show you how to set 等于3 y等于4，我们将其打印出来，然后将其称为
example and I'll show you how to set this up to make it make sense so first 区域函数或区域方法，我们也将其打印出来
this up to make it make sense so first 这种涵盖了我所谈论的我们的一个非常简单的例子
this up to make it make sense so first off what we need to do is we need to 有一个带有一堆实例变量的类，这是众所周知的
off what we need to do is we need to 您正在使用此功能设置实例变量的情况，
off what we need to do is we need to talk a little bit about classes and what 然后将它们与该功能配合使用，但是您会看到我们何时
talk a little bit about classes and what 编译这个，我们来看一个Ida，一开始看起来很疯狂
talk a little bit about classes and what they look like when you compile them so 好的，所以当我们在Ida中打开它时，它们全部被编译了，我们看到一个打开的主窗口
they look like when you compile them so 在这里，我们要跳转到此功能，现在我要去做的是
they look like when you compile them so here we have a simple C++ class and it 使用Ida的十六进制D编译器是付费产品
here we have a simple C++ class and it 不幸的是，我们尝试使用Ida反汇编程序来完成所有分类教程
here we have a simple C++ class and it has two instance variables width and 它是免费提供的，但可用于任何反向工程，
has two instance variables width and 您实际上是在对恶意软件进行真正的反向工程
has two instance variables width and height and when you compile it the 这不是不可能，但是如果没有编译器的话真的很难做
height and when you compile it the 这基本上是很慢的，因为您必须重建所有
height and when you compile it the concept of a class is actually lost it 该程序集的C流程，现在花了很长时间，指导编写
concept of a class is actually lost it 或者就像我只称其为GG Hydra那样，它具有D编译器
concept of a class is actually lost it doesn't exist anymore and all you're 您第一次问世时，我们曾考虑过使用G Hydra做一些教程
doesn't exist anymore and all you're 或家伙吸引，但这不是我们的事，您知道我认为我们宁愿表现
doesn't exist anymore and all you're left with our two variables sitting in 你们是我们自己分析事物的方式，而我永远也不会使用地理
left with our two variables sitting in 你知道这取决于你们想要什么，但我死了
left with our two variables sitting in memory somewhere so like I said in some 我们没有使用它，所以我不会假装我会使用它
memory somewhere so like I said in some 所以我们确实使用了X射线反编译器，所以让我们f5弹出它，然后
memory somewhere so like I said in some cases this is enough to analyze simple 我们将看到我们到达这里，所以这就是我在说的
cases this is enough to analyze simple 所以您可以在这里看到的SIA这是我们正在打印的打印声明
cases this is enough to analyze simple malware if those variables are being 我们将矩形设置为X＆Y X 3 y 4，然后是
malware if those variables are being 我们在该区域打印该区域，您可以看到我们正在将变量传递给
malware if those variables are being referenced directly in the code it's not 这里的区域来自此功能，因此仅基于源
referenced directly in the code it's not 代码并了解我们对此的了解，我认为这是获取区域
referenced directly in the code it's not a big deal but you can come across some 而且很明显，我们看到3和4的地方就是设置
a big deal but you can come across some 现在当然值，如果您进行反向工程，您将不会知道
a big deal but you can come across some pretty interesting scenarios like this 所以我只是带您了解如何做到这一点
pretty interesting scenarios like this 没有真正从源代码知道所以我要做的第一件事
pretty interesting scenarios like this where you have sort of a mystery 这是我要弹出的函数，看看它的作用，所以我们弹出
where you have sort of a mystery 如果我们在这里弹出，它看起来就像是另一个函数的包装
where you have sort of a mystery variable and this is again what will tip 在这里，我们开始看到一些有趣的东西，以便我们可以再次看到
variable and this is again what will tip 就像我在一开始向你们展示的那样，这是一个数组，而你
variable and this is again what will tip you off that you're dealing with some 将值分配给下一个数组，这样就可以立即使用
you off that you're dealing with some 这里有问题，有些地方不正确
you off that you're dealing with some struts and some C++ is when you have 因此，如果我们返回，我们可以看到Ida已为此修复了类型定义，因此
struts and some C++ is when you have 他们实际上已经为此功能，所以他们实际上添加了一个额外的参数
struts and some C++ is when you have these mystery variables so what I mean 如果我们回到这里回到主功能，您会看到
these mystery variables so what I mean 他们已经自动添加了这些额外的东西，他们意识到需要
these mystery variables so what I mean here is here's our class we have a 函数中的一个额外参数，如果您是反向的，这是一个快速提示
here is here's our class we have a 工程Ida并不总是知道何时进行拆卸，
here is here's our class we have a method for the class here where we D编译正确数量的参数，如果您打开
method for the class here where we 功能，如果您向下钻取，通常会弄清楚
method for the class here where we multiply the width and the height to get 如果有一个缺少的论点，那么您可以看到那是他们的观点
multiply the width and the height to get 在这里，他们添加了一个，就像我之前对C ++和对象所说的，
multiply the width and the height to get the area of the rectangle and we return 总是将第一个参数传递给函数将是
the area of the rectangle and we return 指向该类的内存对象的指针，所以这就是您所有实例的位置
the area of the rectangle and we return that so you have an area function and 变量将被存储，这就是我们现在在这里看到的
that so you have an area function and 在这一点上，我们真的不知道这是C ++，还是不确定您是否知道
that so you have an area function and the two instance variables here are 显然，您可以检查编译器类型和类似的东西，但是让我们说
the two instance variables here are 我们不太确定，所以只要您看到任何东西，我都会说这是您的第一个提示
the two instance variables here are multiplied together and returned now 它通过引用传递变量，所以他们正在做的是
multiplied together and returned now 接受这个V 5自变量V 5，然后他们传递指向该地址的地址
multiplied together and returned now somewhere later on your code you've 可以自动提示您该功能的功能
somewhere later on your code you've 这是通过引用而不是通过值传递的，所以他们要做的是
somewhere later on your code you've already instantiated the rectangle class 在函数中对该变量进行一些工作，只要您将其视为
already instantiated the rectangle class 传递给我的第一个变量告诉我，这是
already instantiated the rectangle class I haven't showed that and you're just 那可能是一个类的实例对象，通常
I haven't showed that and you're just 您在这里看到的内容再一次在第二个功能中看到它用完了
I haven't showed that and you're just going to call this area function or area 这种提示，您可以看到它现在将被使用几次
going to call this area function or area 在此功能上提示您，您可能想弄清楚发生了什么
going to call this area function or area method so that all looks fine here but 在继续进行反向工程之前使用此变量
method so that all looks fine here but 因为您可能会遇到这样的情况：您所知道的事情看起来真的很奇怪
method so that all looks fine here but when it gets compiled into assembly and 让我们来看看这个功能，我会告诉你我的意思是您弹出
when it gets compiled into assembly and 这个功能是这个功能的包装器
when it gets compiled into assembly and then either tries to make some sense of 在这里，我们有一个奇怪的场景，所以您没有真正的方法
then either tries to make some sense of 弄清楚到底发生了什么，直到弄清楚这是什么
then either tries to make some sense of it doing the decompiler you end up with 因此，让我们回到此处，我们将尝试找出所有设置方法，以便
it doing the decompiler you end up with 最好的方法是找到引用该变量的第一个地方
it doing the decompiler you end up with something crazy like this so you guys 在函数中，然后深入研究它，看看它实际在哪里
something crazy like this so you guys 操作，所以我的意思是将值分配给它
something crazy like this so you guys have probably seen this before if you've 具有大型内存对象的大型结构，有时会在分配时看到
have probably seen this before if you've 他们为我们分配了一堆空间的功能，就像
have probably seen this before if you've looked at C++ and like I said most 最佳情况，因为在这种情况下我们将确切知道它有多大
looked at C++ and like I said most 我不认为发生这种情况是因为它很小，所以我们可以
looked at C++ and like I said most native code malware C++ not C so you 再次在这里钻进它只是一个包装，让我们在这里看看，这样我们就可以看到
native code malware C++ not C so you 实际上已经分配了一些东西，所以我们现在可以做的就是依靠
native code malware C++ not C so you probably have seen this where you have a 在艾达（Ida）上为我们做出一些决定时，我有时觉得这有点冒险
probably have seen this where you have a 这是错误的，但是速度很快，而且是帮助您快速入门的捷径
probably have seen this where you have a function and pass to the function as a 至少，我们要做的是右键单击并重置指针类型
function and pass to the function as a 所以我们告诉它不是B字，将其重置为默认值，然后我们要做的是
function and pass to the function as a variable a single variable and then 右键单击它，我们说创建一个新的结构类型，您可以在这里看到
variable a single variable and then Ida确定如果这实际上是指向内存中的结构的指针
variable a single variable and then inside that function you will have a 他们会有两个D字z'，他们之所以知道这是因为
inside that function you will have a 他们看了这里使用的偏移量，加上四个。
inside that function you will have a bunch of stuff happening with that 实际上有一个整数被分配给第一个入口点
bunch of stuff happening with that 进入那个内存，然后四个字节后，他们分配另一个整数
bunch of stuff happening with that variable and it will look as if that 所以又有四个字节的单词，所以他们说的是可能有两个D
variable and it will look as if that 内存结构中的单词，所以我们可以接受这个意思是我们什么都不知道
variable and it will look as if that variable is an array it'll look as if 更好，所以在这一点上，让我们假设这就是我们要说的
variable is an array it'll look as if 好吧，听起来不错，他们会
variable is an array it'll look as if you know you're referencing that 自动将此变量转换为结构，因此您现在可以在此处看到
you know you're referencing that 将会引用该结构，这更有意义
you know you're referencing that variable one 因此，他们基本上是将arg2分配给struct和
variable one arg3到第二个D字和struct，所以这已经使它多了一点
variable one able to etc etc just like we saw in that 感觉，但您会看到我们何时返回，我们将继续以此定义事物
able to etc etc just like we saw in that 这里的结构只是复制它，我们可以看到事情会变得一点点
able to etc etc just like we saw in that example I show you in iodine so in that 更有意义，让我们回到这里，您可以看到现在必须将其定义为
example I show you in iodine so in that 结构，所以我们要做的是因为您可以在这里看到它是一个结构
example I show you in iodine so in that case you definitely know something is 我们可以在这里执行的操作是，只需单击功能，然后按Y键即可重新定义
case you definitely know something is 类型，然后我们将该变量的定义更改为
case you definitely know something is not right here and what's happened is 结构，并且像我说的那样通过引用传递，所以他们传递了一个指针
not right here and what's happened is 到它在内存中的位置，所以我们需要那里的小星号
not right here and what's happened is there's an applied memory object that is 知道它是通过引用传递的，所以说好吧，然后我们可以弹出
there's an applied memory object that is 进一步，现在将要定义它，所以您可以在这里看到它的
there's an applied memory object that is passed to all of these calls these class 将被定义为此结构，所以现在这变得更加有意义
passed to all of these calls these class 这个函数现在在这里使用这个结构，所以让我们进入这个
passed to all of these calls these class calls so see how this is the class 功能，看看我们是否可以看到这里发生了什么，所以我们想要的第一件事
calls so see how this is the class 我们要做的是重新定义函数定义，将鼠标悬停在它上面
calls so see how this is the class rectangle and the method area so anytime 按Y，我们将更改参数，因为再次知道
rectangle and the method area so anytime 参数是一个结构，因此我们将参数更改为此结构
rectangle and the method area so anytime you see this in C++ it's implied that 再一次，您可以在这里看到安培沙，因此它被参考传递
you see this in C++ it's implied that 我们将其更改为星号，然后一旦弹出
you see this in C++ it's implied that the object memory for that class is 您可以看到它实际上是直接传递给此函数的
the object memory for that class is 只是一个跳跃，所以我们将重新定义它以及结构，然后
the object memory for that class is actually passed into this function which 当我们跳到这里看时，这更有意义，所以我们可以看到
actually passed into this function which 这实际上是第一个或第二个D字乘以第一个D
actually passed into this function which is why we see a variable being passed 那个结构中的单词，他们正在接受它的结果，所以再次
is why we see a variable being passed 与该区域相同，所以让我们回到这里的初始功能，我们将看到
is why we see a variable being passed into the function here now the problem 如果我们不知道这是怎么回事
into the function here now the problem 所以我们可以看到这里的打印语句是矩形3乘以4乘以x乘以y
into the function here now the problem is that Ida and the compiler etc don't 让我们重命名类型，将arg1更改为X并更改
is that Ida and the compiler etc don't 第二个为什么？好的，然后我们将其弹出，我想我们要命名
is that Ida and the compiler etc don't know that this is actually a struct 它作为矩形设置XY好，实际上就像我说的
know that this is actually a struct 它只是该课程的包装，所以我们将再次更改此名称，
know that this is actually a struct which contains the class variables all 我们将其称为环绕矩形集1 XY，这是真正的说唱
which contains the class variables all 真正的一个，所以我们要重命名该矩形集XY，所以这只是一个
which contains the class variables all it knows is that it's a pointer to 命名约定，您不必这样做，这只是我的方式
it knows is that it's a pointer to 通常这样做是因为如果您有一个函数，它的唯一目的是调用另一个函数
it knows is that it's a pointer to memory and that pointer is the very 函数我要么在它前面放一个J，这就是Ida的意思
memory and that pointer is the very 像跳到它上面，或者我只是说唱在它前面，让自己知道
memory and that pointer is the very first variable in the struct so what it 它包装了另一个函数，所以这意味着我可以为此设置类型
first variable in the struct so what it 该函数的类型定义，所以我们知道这是Arg X，因为我们
first variable in the struct so what it ends up looking like in ayat is it looks 可以在这里看到，然后第二个就可以了
ends up looking like in ayat is it looks 对，然后跳进去，所以我们拥有了所有这些
ends up looking like in ayat is it looks like you're just passing a single 现在很有意义，所以您知道X在这里，让我们重命名，这是很酷的部分
like you're just passing a single 在这里，让我们在结构中重命名该第一个变量，以便在您按n时
like you're just passing a single variable to the class and then once you 在这里您可以将其重命名并命名为X ok，然后将第二个重命名
variable to the class and then once you 这里一个按n命名Y好的，所以我们现在可以知道我们正在设置x和y
variable to the class and then once you get in the class you'd be compile it you 变量或矩形的类实例的变量，因此
get in the class you'd be compile it you 让我们在这里弹出我们的主要功能，然后将此栏重命名为
get in the class you'd be compile it you look at it and you see all these extra 这个词在面向对象的程序设计中经常用到
look at it and you see all these extra 用于实例化类的内存对象或用于实例化对象的实例化对象
look at it and you see all these extra variables that seem to come from nowhere 类，这通常意味着什么，这就是为什么它只是一个
variables that seem to come from nowhere 命名约定在Ida中实际上并不意味着有什么特别之处，但我
variables that seem to come from nowhere where did they come from so that's 只是重命名它，这样我们才知道它到底是什么，所以让我们
where did they come from so that's 在这里弹出我们的其他功能，再看看它在做什么，这是一个
where did they come from so that's really what's happening here and it 这个函数的包装器，所以当我们命名这个时，我们要命名这个
really what's happening here and it 包装让我们进入其中，然后将变量重命名为内存
really what's happening here and it could be really confusing if you don't 对象显然已在此处传播，因此结构名称跟随变量
could be really confusing if you don't 无论走到哪里，我们现在都可以确切看到正在发生的情况
could be really confusing if you don't understand that or if you don't if you X，他们正在返回结果，所以这显然是好的区域。
understand that or if you don't if you 在那里，我们非常简单，无需定义该结构并重命名
understand that or if you don't if you haven't defined this as a struct so now 再次在结构内部变量，这真的不会太有意义
haven't defined this as a struct so now 但是通过重命名进一步发展他们现在所处的位置，这使得
haven't defined this as a struct so now let's take a look at what happens when 感觉我们可以继续进行Burress工程，如果我们弹出
let's take a look at what happens when 我们知道，这就是我们的名字，这只是获得区域的跳跃
let's take a look at what happens when you tell Lida that this is actually a 我说我真的知道这只是一个跳转，所以他们把一个JI
you tell Lida that this is actually a 使用wrap而不是J，但这只是我个人的喜好，所以我们
you tell Lida that this is actually a memory structure and it should treat it 可以看到这实际上是括号区域，我们可以阅读
memory structure and it should treat it 这是我们的区域，然后我们知道我们正在打印该区域，因此
memory structure and it should treat it as a pointer to a struct not a pointer 简而言之，这就是您的操作方式
as a pointer to a struct not a pointer 如果要实际编辑，我还有最后一件事要告诉您
as a pointer to a struct not a pointer to a single variable so I'm gonna show 您使用Ida自动创建的这些支撑架，您可以进入视图
to a single variable so I'm gonna show 子视图本地类型，您的结构就在这里，您可以右键单击
to a single variable so I'm gonna show you how to do so HIDA in a second but 编辑它，然后您会得到一个不错的C样式编辑窗口，因此这很漂亮
you how to do so HIDA in a second but 很酷，如果您对某些恶意软件进行反向工程，这就是您知道的编辑方式
you how to do so HIDA in a second but here I'm just showing you an example 并且您将保持反向并共享它的不同版本
here I'm just showing you an example 始终将这些支撑保持在周围，以便将来使用
here I'm just showing you an example where we've done a struct definition of 可能会弹出该结构的其他位置的恶意软件版本
where we've done a struct definition of 在这些Struts视图中，因此，如果您进入子视图Struts，则可以看到
where we've done a struct definition of the two instance variables here to int 就在这里，这种观点的唯一问题是它不是我
the two instance variables here to int 确定如何说这就像结构的内存表示，所以如果您
the two instance variables here to int with the night and we have now instead 要编辑它，您必须在需要扩展的地方做一些愚蠢的事情
with the night and we have now instead 结构类型或您喜欢的添加，您知道可以添加到它或任何咖啡中
with the night and we have now instead of using int for this variable we have 等等，这有点笨拙，所以我实际上想使用
of using int for this variable we have 局部类型，它为您提供了我向您展示的C定义，然后
of using int for this variable we have defined it as that structure so we've 这样，您很容易知道，如果有结构，就很容易进行操作
defined it as that structure so we've 您已经导入并且它们不在本地类型中，则可以随时将它们添加到
defined it as that structure so we've done a destruct definition so what that 局部类型（如果仅存在于Struck的观点中），这没什么大不了的
done a destruct definition so what that 再次，我总是更喜欢将它们导入为本地类型，然后以这种方式使用
done a destruct definition so what that tells is that anytime that there's a 好吧，总之有结构和构造函数，我希望这不是
tells is that anytime that there's a 太无聊了，但是就像我说的那样，这是我们挖掘之前的必备要素之一
tells is that anytime that there's a pointer to this memory it's a pointer to 即将进行一些更复杂的逆向工程
pointer to this memory it's a pointer to 成为一个教程，我在加密货币上还有一个类似的快速提示教程
pointer to this memory it's a pointer to the whole struct and it's not a pointer 然后我们将做一个关于为老鼠构建配置提取器的教程
the whole struct and it's not a pointer 但同样，您必须先了解C ++基础结构的构造函数和结构
the whole struct and it's not a pointer to just a single variable again I'll 我们开始讨论，直到下一次继续揭露1美元背后的机制
to just a single variable again I'll 保持好奇
to just a single variable again I'll show you guys this in Ida this is just a 您
show you guys this in Ida this is just a