CODEWITHSUNDEEP
c++memorydata-structuresreverse-engineering
rflxdev
rflxdev

Reputation: 143

c++ convert memory into data structure

When debugging an application I have found in memory a structure that I am 100% certain only consists of 4 strings. Though I am not quite sure how I would convert it to a data structure so I can use the structures pointer address to access values. For example here is what the data struct looks like in memory (as an example lets say it is CONSISTENTLY located at the memory address 0x123456) enter image description here

The data structureconsists of 4 separate strings

string 1 = ad
string 2 = dgdhkkkkkkhkk
string 3 = ggghhjk
string 4 = dgcfoh

And I have tried creating a data struct like

struct reversedConnectionDat_t
{
    char * data1;
    char * data2;
    char * data3;
    char * data4;
}

and this is how I tried accessing the data

reversedConnectionDat_t * storeDat = (reversedConnectionDat_t*)0x123456;
print(storeDat->data3);

But it does not seem to work. Am I not reading the strings from memory properly?

(Oh and the strings will sometimes change from what I posted in the example code posted above, i.e sometimes string 1 will be 7 in length and string 3 will only be 2 in length etc...)

Upvotes: 0

Views: 1183

Answers (4)

Jim Mischel
Jim Mischel

Reputation: 134045

I think you've mis-identified that data structure. I suspect that what you have is three independent buffers, each of which can hold one or more null-terminated strings.

The first structure is 68 bytes long and contains "ad\0dgdhkkkkkkhkk\0" (followed by enough \0 to fill the buffer.

It's possible that this buffer is really only 64 bytes long, and that the four bytes after it are used for some other data element.

The second buffer looks to be 64 bytes long, containing a single string and padded with \0 characters to fill out the 64 bytes.

It's impossible to say how long the third buffer is. All we know is that it's long enough to hold the string "dgcfoh\0". I'd guess that the buffer is 64 bytes long, but be willing to revise that opinion if I get more data.

I think the structure you want is:

struct s
{
    char data1[68]; // buffer holds one or more null-terminated strings
    char data2[64];
    char data3[64].
}

Based on the scant information you've given us, that's what I'd start with. Then you need a way to parse a buffer of null-terminated strings. That is, get the two individual strings from the first buffer. That's a pretty easy bit of C code.

Upvotes: 1

Petar Velev
Petar Velev

Reputation: 2355

You are using pointers(char*) and the structure size of your structure is the size of the 4 pointers. If you want to get the strings you should use arrays(char[]) with fixed size.

This will only work if your string size are equal to the buffer size.

IMO the best way is to get the in a char array then find the null terminators /0 and then configure your pointers to point to the start of each string(at the start and right after the first 3 null terminators).

char* pointerToMem = something; //your strings data
yourStruct.str1 = pointerToMem;
while(*pointerToMem != '\0')
{
    pointerToMem++;
}
yourStruct.str2 = pointerToMem + 1;

This is how you can make the struct of pointers work. This code is not optimal and you should not use it as it but it shows how can you get the strings from the memory. To have a C string you only need the address of the first character and some null terminator at the end.

Upvotes: 0

WhiteSword
WhiteSword

Reputation: 101

I couldn't understand what's wrong with your code except for your magicnumber:0x123456, casting which might not suit your structure. Are you sure your magic-number results in data compatible to the struct defined by you? Like, if you'll try to access storeDat->data3, it'll definitely be leading to seg-fault except you do something as follows or you are very lucky.

struct R{
    char *a;
    char *b;
};

int main(void)
{
    struct R *r1 = (struct R*) malloc(sizeof(struct R));
    r1->a = "12333";      //Pointing to a string literal
    r1->b = "12331";      //Pointing to a string literal

    int address = (int)&r1;
    struct R *r2 = (struct R*) address;
    std::cout<<r2->b;
    return 0;
}

P.S. - I'm not a good programmer. But was just curious to answer, as I thought it might be of some help. Sorry, if I couldn't understand your problem properly.

Upvotes: 0

T. Edison
T. Edison

Reputation: 21

You have a pointer to a structure of pointers so even if you point the structure to the correct memory address, you still have uninitialized pointers inside the structure. You need to provide them with actual memory. I would try setting up your structure like this ...

struct reversedConnectionDat_t
{
    char data1 [3];
    char data2 [50];
    char data3 [50];
    char data4 [50];
}

BTW, I didn't count the spaces. I just kind of guessed at it but you get the idea.

Upvotes: 2

Related Questions