此字符串代表serv_addr缓冲区什么格式？

Question

So I've been reading this tutorial on how to use Frida: https://www.frida.re/docs/functions/ and I've encountered the following:

$ ./client 127.0.0.1
connect() is at: 0x400780

Here's the serv_addr buffer:
02 00 13 88 7f 00 00 01 30 30 30 30 30 30 30 30
Press ENTER key to Continue

The tutorial states that the bytes represent 0x1388 or 5000 so clearly its not in hex or decimal. I tried using base64 converters to convert the string to see if 0x1388 or 5000 comes up but no luck.

What format is this exactly in? I haven't done low level programming lately and if i recall, bytes are groups of 8 bits 1s and 0s.

EDIT: Yup, the tutorial states this represents a struct. But how did he know that it represents 0x1388? If I received a string like this is there a way for me to understand that it represents a particular value without being the author of the code that sent the message?

Answer 1

The relevant parts of the code is this:

printf ("\nHere's the serv_addr buffer:\n");
b = (unsigned char *) &serv_addr;
for (i = 0; i != sizeof (serv_addr); i++)
  printf ("%s%02x", (i != 0) ? " " : "", b[i]);

What it is doing is simply printing the raw data from the structure serv_addr (which is of type struct sockaddr_in ).

There's no "string" here (in the sense of a C null-terminated byte string).

The 0x1388 is the value of serv_addr.sin_port , which is printed as the third and fourth byte ( 13 and 88 , in network ( big endian ) byte order).

---

Knowing that the output is the raw data of a sockaddr_in structure, we can decipher the data easily

• 02 00 This is the sin_family member, with the value 2 (decimal). This value corresponds to AF_INET . This is in host byte order.

• 13 88 This is (as already mentioned) the network byte order of the port in sin_port .

• 7f 00 00 01 This is the sin_addr member, and corresponds to the IP address 127.0.0.1 ( 7f is 127 ). This is also in network byte order.

• The rest, 30 30 30 30 30 30 30 30 , is "garbage" that fills the structure up to a common size for struct sockaddr , which is 16 bytes long.