Showing posts from June, 2021

Obtain struct offsets with Clang's memory layout

 One of the most interesting things to do when instrumenting binaries with FRIDA is the ability to read structs because these are used by multiple syscalls in different systems, some examples of this usage can be found in the stat API or in Window’s GetSystemInfo API: The hard part of parsing structs with FRIDA is that it is required to manually calculate their offsets which requires taking into account the architecture of the process, datatypes and size of pointers. To make this job easier, clang’s memory layout feature is very helpful in documented cases. For a quick example we will take MSDN’s __stat API defined as: int _stat(    const char *path,    struct _stat *buffer ); With clang, we can get the record layout with two steps: clang -E [-I] test.c > ptest.c Which will generate a file that can be later used with the -cc1 parameter: clang -cc1 -fdump-record-layouts ptest.c And generate us t