我正在尝试从 OpenSSL 1.0.2l（静态链接，没有调试符号）中提取主密钥。
我正在使用 x64dbg，我能够定位int SSL_connect(SSL *s)方法，所以我在那里有一个断点（断点被击中）。结果，我有一个指向SSL包含SSL_SESSION *session成员的参数的指针，主密钥位于该成员中。
该SSL指针指向我在垃圾堆里的下列场所：
有没有什么简单的方法可以SSL_SESSION *session在这里找到我的会员？还有其他工具建议吗？
OpenSSL 源代码的有用链接：
我将使用 x64dbg 方法添加自定义类型：
{ "types": [ { "type": "unsigned int", "name": "DWORD" }, { "type": "_FILETIME*", "name": "LPFILETIME" } ], "structs": [ { "name": "ST", "members": [ { "type": "char", "name": "a", "arrsize": 0, "offset": -1 }, { "type": "int", "name": "y", "arrsize": 0, "offset": -1 } ] }, { "name": "_FILETIME", "members": [ { "type": "DWORD" , "name": "dwLoDateTime" }, { "type": "DWORD", "name": "dwHighDateTime" } ] }, { "name": "BLUB", "members": [ { "type": "short", "name": "c" }, { "type": "int", "name": "d", "arrsize": 2 } ] }, { "name": "TEST", "members" : [ { "type": "int", "name": "a" }, { "type": "char", "name": "b" }, { "type": "BLUB", "name" : "e" }, { "type": "int", "name": "f" } ] }, { "name": "POINTEE", "members": [ { "type": "int", " name": "n" }, { "type": "TEST", "name": "t" } ] }, { "name": "POINTER", "members": [ { "type": "int" , "name": "x" }, { "type": "POINTEE*", "name": "next" }, { "type": "int", "name": "y" } ] }, { "name": "LIST_ENTRY", "members": [ { "type": "int", "name": "x" }, { "type": "LIST_ENTRY*", "name": "next" }, { "type": "int", "name" : "y" } ] }, { "name": "STRINGTEST", "members": [ { "type": "const char*", "name": "str" }, { "type": "const wchar_t *", "name": "wstr" } ] } ], "unions": [ { "name": "UT", "members": [ { "type": "char", "name": "a" }， { “类型”："short", "name": "b" }, { "type": "int", "name": "c" }, { "type": "long long", "name": "d" } ] } ], "functions": [ { "rettype": "int", "callconv": "cdecl", "noreturn": false, "name": "strcasecmp", "arguments": [ { "type": " const char*", "name": "s1" }, { "type": "const char*", "name": "s2" } ] } ] }"callconv": "cdecl", "noreturn": false, "name": "strcasecmp", "arguments": [ { "type": "const char*", "name": "s1" }, { "type ": "const char*", "name": "s2" } ] } ] }"callconv": "cdecl", "noreturn": false, "name": "strcasecmp", "arguments": [ { "type": "const char*", "name": "s1" }, { "type ": "const char*", "name": "s2" } ] } ] }
导入类型后，您可以使用VisitType cmd 查看它。附加信息： x64dbg 类型系统 Weekly Digest 14 - 类型