reven2.types._struct.Struct

A user-defined, named structure type. Can actually also be a union type.

The supported way of getting a Struct is to read type information from the debug object of a binary, using the reven2.ossi.Binary.exact_type method.

>>> struct_ty = next(server.ossi.executed_binaries("ntoskrnl")).exact_type("_OBJECT_ATTRIBUTES")

A Struct obtained in this way can then produce reven2.types.StructInstances by passing it as the type in the reven2.trace.Context.read method.

>>> struct_instance = ctx.read(reven2.address.LogicalAddress(0x65dd168), struct_ty)

To see the fields of a Struct at a glance, you can use its string representation that will list them in a custom format.

>>> print(struct_ty)
StructKind.Struct _OBJECT_ATTRIBUTES /* 0x30 */ {
    /* 0x0 */ Length : U32,
    /* 0x8 */ RootDirectory : void*,
    /* 0x10 */ ObjectName : _UNICODE_STRING*,
    /* 0x18 */ Attributes : U32,
    /* 0x20 */ SecurityDescriptor : void*,
    /* 0x28 */ SecurityQualityOfService : void*,
}

You can also iterate over the fields programmatically with the Struct.fields method, and get a specific field from its name with the Struct.field and Struct.bitfield methods (use the latter for bitfields, and the former for regular fields, or be welcomed by a ValueError).