我正在使用radare2 来解构一个二进制blob。在定义位字段值时,似乎没有语法来指定包含枚举的字段的宽度。例如使用 C 结构如下:
struct mystruct{
uint32_t myint,
uint8_t bitfield1,
uint8_t bitfield2,
uint8_t bitfield3,
uint8_t bitfield4
}
我会声明以下内容:
"td enum byte_enum {bit_8=0x80, bit_7=0x40,bit_6=0x20,bit_5=0x10, bit_4=0x08,bit_3=0x04,bit_2=0x02,bit_1=0x01}"
pf.binary xBBBB myint (byte_enum)bitfield1 (byte_enum)bitfield2 (byte_enum)bitfield3 (byte_enum)bitfield4
但是每个字节都被解释为一个完整的 32 位 int(尽管偏移量只增加了 1,这让我感到困惑)
[0x00000000]> px 16
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0x00000000 4142 4344 3132 3334 0aff ffff ffff ffff ABCD1234........
[0x00000000]> pf.binary
myint : 0x00000000 = 0x44434241
bitfield1 : 0x00000004 = bitfield1 (bitfield) = 0x34333231 : bit_1 | bit_5 | bit_6 | 0x200 | 0x1000 | 0x2000 | 0x10000 | 0x20000 | 0x100000 | 0x200000 | 0x4000000 | 0x10000000 | 0x20000000
bitfield2 : 0x00000005 = bitfield2 (bitfield) = 0x0a343332 : bit_2 | bit_5 | bit_6 | 0x100 | 0x200 | 0x1000 | 0x2000 | 0x40000 | 0x100000 | 0x200000 | 0x2000000 | 0x8000000
bitfield3 : 0x00000006 = bitfield3 (bitfield) = 0xff0a3433 : bit_1 | bit_2 | bit_5 | bit_6 | 0x400 | 0x1000 | 0x2000 | 0x20000 | 0x80000 | 0x1000000 | 0x2000000 | 0x4000000 | 0x8000000 | 0x10000000 | 0x20000000 | 0x40000000 | 0x80000000
bitfield4 : 0x00000007 = bitfield4 (bitfield) = 0xffff0a34 : bit_3 | bit_5 | bit_6 | 0x200 | 0x800 | 0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000 | 0x200000 | 0x400000 | 0x800000 | 0x1000000 | 0x2000000 | 0x4000000 | 0x8000000 | 0x10000000 | 0x20000000
我尝试了 [1]B 语法,但radare2 没有采用正确的字节,它只是将 4 字节值截断为 LSB,如果您使用大端(就像我一样),这恰好减少了 3 个字节。这可能是一个错误。