通过综合分析识别一个全局变量的类型-优快云博客

以下是IDA生成的关于一个名为page_s_vert_rev_ifr__g_rta_params的全局变量的伪代码：

//第1段
__int16 page_s_vert_rev_ifr__g_rta_params[]; // weak
int dword_2A8E994[]; // weak
char byte_2A8E998[24]; // weak

//第2段
  result = 12 * a1;
  page_s_vert_rev_ifr__g_rta_params[result / 2] = 0;
  dword_2A8E994[result / 4] = 0;
  byte_2A8E998[result] = 3;

//第3段
    v6 = 12 * a2;
    *(__int16 *)((char *)page_s_vert_rev_ifr__g_rta_params + v6) = 0;
    *(int *)((char *)dword_2A8E994 + v6) = 0;
    byte_2A8E998[v6] = 3;

//第4段
  int v60; // ecx
  int v61; // edx
  bool v62; // al

//第5段
              v60 = page_s_vert_rev_ifr__g_rta_params[6 * a2];
              v61 = dword_2A8E994[3 * a2];
              v62 = byte_2A8E998[12 * a2];

以下是汇编清单中的page_s_vert_rev_ifr__g_rta_params：

.bss:02A8E990 ; __int16 page_s_vert_rev_ifr__g_rta_params[]
.bss:02A8E990 _page_s_vert_rev_ifr__g_rta_params dw ?
.bss:02A8E992 align 4
.bss:02A8E994 ; int dword_2A8E994[]
.bss:02A8E994 dword_2A8E994 dd ?
.bss:02A8E998 ; char byte_2A8E998[24]
.bss:02A8E998 byte_2A8E998 db ?
.bss:02A8E999 db    ? ;
.bss:02A8E99A db    ? ;
.bss:02A8E99B db    ? ;
.bss:02A8E99C db    ? ;
.bss:02A8E99D db    ? ;
.bss:02A8E99E db    ? ;
.bss:02A8E99F db    ? ;
.bss:02A8E9A0 db    ? ;
.bss:02A8E9A1 db    ? ;
.bss:02A8E9A2 db    ? ;
.bss:02A8E9A3 db    ? ;
.bss:02A8E9A4 db    ? ;
.bss:02A8E9A5 db    ? ;
.bss:02A8E9A6 db    ? ;
.bss:02A8E9A7 db    ? ;
.bss:02A8E9A8 db    ? ;
.bss:02A8E9A9 db    ? ;
.bss:02A8E9AA db    ? ;
.bss:02A8E9AB db    ? ;
.bss:02A8E9AC db    ? ;
.bss:02A8E9AD db    ? ;
.bss:02A8E9AE db    ? ;
.bss:02A8E9AF db    ? ;

由此可见，page_s_vert_rev_ifr__g_rta_params及其后续的dword_2A8E994与byte_2A8E998是一个整体，它们共占24个字节。

这32个字节是一个长度为2的数组，即数组有2个元素，每个元素占12个字节。

该元素由3个分量组成，其类型分别是：uint16_t、uint32_t、uint8_t。

因此，我们可以为page_s_vert_rev_ifr__g_rta_params定义一个结构类型。

上述伪代码修改如下：

typedef struct
{
  uint16_t _0;
  uint32_t _4;
  uint8_t _8;
} rta_params_t;

//第1段
rta_params_t page_s_vert_rev_ifr__g_rta_params[2]; 

//第2段
  page_s_vert_rev_ifr__g_rta_params[a1]._0 = 0;
  page_s_vert_rev_ifr__g_rta_params[a1]._4 = 0;
  page_s_vert_rev_ifr__g_rta_params[a1]._8 = 3;

//第3段
  page_s_vert_rev_ifr__g_rta_params[a2]._0 = 0;
  page_s_vert_rev_ifr__g_rta_params[a2]._4 = 0;
  page_s_vert_rev_ifr__g_rta_params[a2]._8 = 3;

//第4段
  uint16_t v60; // ecx
  uint32_t v61; // edx
  uint8_t v62; // al

//第5段
              v60 = page_s_vert_rev_ifr__g_rta_params[a2]._0;
              v61 = page_s_vert_rev_ifr__g_rta_params[a2]._4;
              v62 = page_s_vert_rev_ifr__g_rta_params[a2]._8;