滴水逆向三期笔记与作业——02C语言——13 指针3、4
- 一、模拟实现CE的数据搜索功能
OneNote迁移
一、模拟实现CE的数据搜索功能
//其中有0xAA,超过有符号char范围,在vscode中会报错,所以使用unsigned char
unsigned char data[100] =
{
0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x07,0x09,
0x00,0x20,0x10,0x03,0x03,0x0C,0x00,0x00,0x44,0x00,
0x00,0x33,0x00,0x47,0x0C,0x0E,0x00,0x0D,0x00,0x11,
0x00,0x00,0x00,0x02,0x64,0x00,0x00,0x00,0xAA,0x00,
0x00,0x00,0x64,0x10,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x02,0x00,0x74,0x0F,0x41,0x00,0x00,0x00,
0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x0A,0x00,
0x00,0x02,0x74,0x0F,0x41,0x00,0x06,0x08,0x00,0x00,
0x00,0x00,0x00,0x64,0x00,0x0F,0x00,0x00,0x0D,0x00,
0x00,0x00,0x23,0x00,0x00,0x64,0x00,0x00,0x64,0x00
};
//step代表步长,即表示字节长度
void find(int step){
if (step == 1)
{
unsigned char* p = (unsigned char*)data;
for (int i = 0; i < 100 - step + 1; i++)
{
if (*(p + i) == 0x64)
{
printf("0x%x \t 0x%x \n",(p + i), *(p + i));
}
}
}else if (step == 2)
{
unsigned short* p = (unsigned short*)data;
for (int i = 0; i < 100 - step + 1; i++)
{
if (*((unsigned short*)&data[i]) == 0x64)
{
printf("0x%x \t 0x%x \n", (&data[i]), *((&data[i])));
}
}
}else if (step == 4)
{
for (int i = 0; i < 100 - step + 1; i++)
{
if (*((unsigned int*)&data[i]) == 0x64)
{
printf("0x%x \t 0x%x \n", (&data[i]), *((&data[i])));
}
}
}
}
int main(int argc, char* argv[]){
find(1);
find(2);
find(4);
return 0;
}