YYImage 中学习的内存搜索和字节对比的方式

一 . 获取指定长度字节的数据并打印出来

1.定义一个结构体

typedef struct _byte_3_context {
    char byte_1;
    char byte_2;
    char byte_3;
}byte_3_ctx;

2.获取到具体的字节数据

	NSString *filePath = [[NSBundle mainBundle] pathForResource:@"test" ofType:@"rar"];
    NSData *rarD = [NSData dataWithContentsOfFile:filePath];
    byte_3_ctx * rarP1 = (byte_3_ctx *)rarD.bytes;
    int c = [self intValueWithContext:rarP1];
    NSLog(@"%x", c);

// - 还可以修改某个字节的值
    char *offset = (char *)(rarD.bytes + 2);
    *offset = 0xff;

3.调用方法 将结构体内的数据转换成为一个 int 类型的整数

+(int)intValueWithContext:(byte_3_ctx *)ctx{
    NSLog(@"%d, %d", ctx->byte_1, (ctx->byte_1 << 2 * 8));
    int result = (ctx->byte_1 <<  2 * 8) + (ctx->byte_2 << 1 * 8) + (ctx->byte_3 << 0 * 8);
    return result;
}

4.查看转化前后的结果
rarD.bytes = 0x52, 0x61, 0x72, 0x21 …;
rarP1 = 0x52, 0x61, 0x72, 0x21 …;
*rarP1 = 0x726152;
c = 5398898 = 0x526172;

二 .仿CE 的内存搜索

char address[40] = {
        0x10, 0x11, 0x12, 0x13, 0x14,
        0x20, 0x21, 0x22, 0x23, 0x24,
        0x30, 0x31, 0x32, 0x33, 0x34,
        0x40, 0x41, 0x42, 0x43, 0x44,
        0x50, 0x51, 0x52, 0x53, 0x54,
        0x60, 0x61, 0x62, 0x63, 0x64,
        0x70, 0x71, 0x72, 0x73, 0x74,
        0x80, 0x81, 0x82, 0x83, 0x84,
        
    };
    char *p = address;
    for (int i = 0; i < 40; i++) {
        int *c = (int *)(p + i);
        if (*c == 0x84838281) {
            NSLog(@"%x", *c);
            break;
        }else{
            NSLog(@"%d : %x \n", i, *c);
        }
    }

字节码函数调用

// - 函数实现的字节码
char arr[] = {0x55, 0x88, 0xEC, 0x83, 0xEC, 0x40};

// - 定义函数指针 和 调用函数指针
int (*fn)(int, int);
fn = (int (*)(int, int))arr;
int result = fn(2, 3);
printf("%d\n", result);

使用结构体接收强转指针类型

static inline uint32_t yy_swap_endian_uint32(uint32_t value) {
    return
    (uint32_t)((value & 0x000000FFU) << 24) |
    (uint32_t)((value & 0x0000FF00U) <<  8) |
    (uint32_t)((value & 0x00FF0000U) >>  8) |
    (uint32_t)((value & 0xFF000000U) >> 24) ;
}

typedef struct QGStruct1 {
    UInt8 v1;
    UInt8 v2;
    UInt8 v3;
    UInt8 v4;
} Struct1;

typedef struct QGStruct2 {
    UInt16 t1;
    UInt16 t2;
} Struct2;

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        uint32 value = 0x01020304;
        Struct1 s1 = *((Struct1 *)&value);
        NSLog(@"%02x--%02x--%02x--%02x", s1.v1, s1.v2, s1.v3, s1.v4);

        Struct2 s2 = *((Struct2 *)&value);
        NSLog(@"%04x--%04x", s2.t1, s2.t2);
        
        // - 为了让结构体可以正常顺序存储, 这里使用函数交换了字节的顺序;
        uint32 value1 = yy_swap_endian_uint32(value);
        Struct1 s3 = *((Struct1 *)&value1);
        NSLog(@"new : %02x--%02x--%02x--%02x", s3.v1, s3.v2, s3.v3, s3.v4);

        
        NSLog(@"===end===");
        /*
         2019-08-30 15:22:26.631705+0800 Demo_003[6955:1183719] 04--03--02--01
         2019-08-30 15:22:26.632016+0800 Demo_003[6955:1183719] 0304--0102
         2019-08-30 15:22:26.632033+0800 Demo_003[6955:1183719] new : 01--02--03--04
         2019-08-30 15:22:31.586476+0800 Demo_003[6955:1183719] ===end===
         */
    }
    return 0;
}

/*
假设 value 的地址是 0xFFFFFF01- 0xFFFFFF04 布局为 0x04 0x03 0x02 0x01
	当取值使用unit32 方式读取时候, value起始地址是 0xFFFFFF01;
	value = 0xFFFFFF01 (size = 4byte) = 0x01020304; value起始地址是 0xFFFFFF01; 一次取4 字节
  
  	当取值使用QGStruct1结构体读取时候,QGStruct1其实地址是 0xFFFFFF01;
	QGStruct1.v1 = 0xFFFFFF01 (size = 1byte) = 0x04; QGStruct1.v1 起始地址是 0xFFFFFF01; 一次取1字节
	QGStruct1.v2 = 0xFFFFFF02 (size = 1byte) = 0x03; QGStruct1.v2 起始地址是 0xFFFFFF01; 一次取1 字节
	QGStruct1.v3 = 0xFFFFFF03 (size = 1byte) = 0x02; QGStruct1.v3 起始地址是 0xFFFFFF01; 一次取1 字节
	QGStruct1.v4 = 0xFFFFFF04 (size = 1byte) = 0x01; QGStruct1.v4 起始地址是 0xFFFFFF01; 一次取1 字节

  	当取值使用QGStruct2结构体读取时候, QGStruct2其实地址是 0xFFFFFF01;
	QGStruct2.t1 = 0xFFFFFF01 (size = 2byte) = 0x0304; QGStruct2.t1 起始地址是 0xFFFFFF01; 一次取2 字节
	QGStruct2.t2 = 0xFFFFFF03 (size = 2byte) = 0x0102; QGStruct2.t2 起始地址是 0xFFFFFF01; 一次取2 字节
*/