对于一个Rtti数据,可直接采用API转换为其类型name
unsigned
char
datas[128] = {
0x90, 0xEE, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x3F, 0x41, 0x56, 0x41, 0x70, 0x70, 0x6C,
0x65, 0x40, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0xEE, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00,
0x2E, 0x3F, 0x41, 0x56, 0x62, 0x61, 0x64, 0x5F, 0x61, 0x6C, 0x6C, 0x6F, 0x63, 0x40, 0x73, 0x74,
0x64, 0x40, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0xEE, 0x50, 0x00,
0x00, 0x00, 0x00, 0x00, 0x2E, 0x3F, 0x41, 0x56, 0x62, 0x61, 0x64, 0x5F, 0x65, 0x78, 0x63, 0x65,
0x70, 0x74, 0x69, 0x6F, 0x6E, 0x40, 0x73, 0x74, 0x64, 0x40, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x90, 0xEE, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x3F, 0x41, 0x56,
0x65, 0x78, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6F, 0x6E, 0x40, 0x73, 0x74, 0x64, 0x40, 0x40, 0x00
};
const
std::type_info* pxxx = (
const
std::type_info*)datas;
const
char
* c_stxxxr=pxxx->name();
HINSTANCE
hModule = LoadLibraryA(
"VCRUNTIME140.dll"
);
typedef
DWORD
(__stdcall* pFunc)(
void
*,
void
*);
pFunc func1 = (pFunc)GetProcAddress(hModule,
"__std_type_info_name"
);
DWORD
x = 0;
char
* p = (
char
*)datas + 4;
const
char
* c_str = (
const
char
*)func1(p, &x);
printf
(
"%s"
, c_str);
#include <iostream>
#include <Windows.h>
using
namespace
std;
#include <typeinfo>
char
读缓冲[0x1000];
DWORD
WINAPI 线程函数(
LPVOID
参数)
{
HANDLE
g_hEvent = OpenEvent(EVENT_ALL_ACCESS, FALSE, L
"Stop_RTTI_Server32"
);
WaitForSingleObject(g_hEvent, INFINITE);
exit
(0);
return
0;
}
void
子进程() {
HANDLE
hRead = GetStdHandle(STD_INPUT_HANDLE);
HANDLE
hWrite = GetStdHandle(STD_OUTPUT_HANDLE);
DWORD
dw实际读写 = 0;
DWORD
dw当前管道数据量 = 0;
BOOL
bRet = 0;
HANDLE
g_hE子进程写完 = CreateEvent(NULL, FALSE, FALSE, L
"SonWriteOver"
);
HANDLE
g_hE父进程写完 = OpenEvent(EVENT_ALL_ACCESS, FALSE, L
"DadWriteOver"
);
while
(1)
{
WaitForSingleObject(g_hE父进程写完, INFINITE);
bRet = PeekNamedPipe(hRead, NULL, 0, NULL, &dw当前管道数据量, NULL);
if
(bRet)
{
bRet = ReadFile(hRead, 读缓冲, dw当前管道数据量, &dw实际读写, NULL);
const
std::type_info* data = (
const
std::type_info*)读缓冲;
const
char
* cstr_RTTI类型 = data->name();
int
size =
strlen
(cstr_RTTI类型) + 1;
bRet = WriteFile(hWrite, cstr_RTTI类型, size, &dw实际读写, NULL);
SetEvent(g_hE子进程写完);
}
}
};
int
main(
int
argc) {
HANDLE
线程句柄 = ::CreateThread(NULL, 0, 线程函数, NULL, 0, NULL);
::CloseHandle(线程句柄);
子进程();
return
0;
}
#include <iostream>
#include <Windows.h>
using
namespace
std;
#include <typeinfo>
#define 子进程路径 R"(C:\RootFolder\05_VS_Projects\IDAPlugin\MyIdaPlugin\Rtti32Server.exe)"
unsigned
char
datas[128] = {
0x90, 0xEE, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x3F, 0x41, 0x56, 0x41, 0x70, 0x70, 0x6C,
0x65, 0x40, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0xEE, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00,
0x2E, 0x3F, 0x41, 0x56, 0x62, 0x61, 0x64, 0x5F, 0x61, 0x6C, 0x6C, 0x6F, 0x63, 0x40, 0x73, 0x74,
0x64, 0x40, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0xEE, 0x50, 0x00,
0x00, 0x00, 0x00, 0x00, 0x2E, 0x3F, 0x41, 0x56, 0x62, 0x61, 0x64, 0x5F, 0x65, 0x78, 0x63, 0x65,
0x70, 0x74, 0x69, 0x6F, 0x6E, 0x40, 0x73, 0x74, 0x64, 0x40, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x90, 0xEE, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x3F, 0x41, 0x56,
0x65, 0x78, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6F, 0x6E, 0x40, 0x73, 0x74, 0x64, 0x40, 0x40, 0x00
};
char
读缓冲[0x1000];
class
Rtti沟通
{
public
:
Rtti沟通()
{
g_hEStop = CreateEvent(NULL, FALSE, FALSE, L
"Stop_RTTI_Server32"
);
子读 = NULL;
父写 = NULL;
父读 = NULL;
子写 = NULL;
g_hE父进程写完 = CreateEvent(NULL, FALSE, FALSE, L
"DadWriteOver"
);
SECURITY_ATTRIBUTES sa;
sa.nLength =
sizeof
(sa);
sa.lpSecurityDescriptor = NULL;
sa.bInheritHandle = TRUE;
bRet = CreatePipe(&子读, &父写, &sa, 0);
bRet = CreatePipe(&父读, &子写, &sa, 0);
STARTUPINFO si = { 0 };
si.cb =
sizeof
(si);
si.dwFlags = STARTF_USESTDHANDLES;
si.hStdInput = 子读;
si.hStdOutput = 子写;
PROCESS_INFORMATION pi = {};
TCHAR
sz程序路径名[] = TEXT(子进程路径);
BOOL
res = CreateProcess(NULL, sz程序路径名, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
};
void
提交请求(
LPCVOID
Rtti结构地址,
DWORD
Rtti结构大小,OUT
LPVOID
解析字符串存放地址)
{
DWORD
dw实际读写 = 0;
bRet = WriteFile(父写, Rtti结构地址, Rtti结构大小, &dw实际读写, NULL);
SetEvent(g_hE父进程写完);
static
HANDLE
g_hE子进程写完 = OpenEvent(EVENT_ALL_ACCESS, FALSE, L
"SonWriteOver"
);
WaitForSingleObject(g_hE子进程写完, INFINITE);
DWORD
dw当前管道数据量 = 0;
bRet = PeekNamedPipe(父读, NULL, 0, NULL, &dw当前管道数据量, NULL);
if
(bRet)
{
bRet = ReadFile(父读, 解析字符串存放地址, dw当前管道数据量, &dw实际读写, NULL);
}
};
~Rtti沟通() {
SetEvent(g_hEStop);
}
private
:
HANDLE
g_hEStop;
HANDLE
子读 = NULL;
HANDLE
父写 = NULL;
HANDLE
父读 = NULL;
HANDLE
子写 = NULL;
HANDLE
g_hE父进程写完;
BOOL
bRet;
};
void
父进程()
{
Rtti沟通* obj =
new
Rtti沟通();
Sleep(1000);
obj->提交请求(datas,
sizeof
(datas), 读缓冲);
printf
(
"%s\n"
, 读缓冲);
obj->提交请求(datas,
sizeof
(datas), (
char
*)读缓冲+100);
printf
(
"%s\n"
, (
char
*)读缓冲 + 100);
}
int
main(
int
argc) {
父进程();
return
0;
}