16.4.1 Structures

The 'as' command is used to interpret a buffer of bytes using an spcc program (See 'rsc spcc' for more information). Giving a name of function it firstly edits the C code and later runs 'rsc spcc' to compile the parser and interpret the current block. The spcc files are stored in ~/.radare/spcc/, so you can edit the structure definition by browsing in this directory.

Here's a sample session:

[0xBFBEAA80]> as
Usage: as [?][-][file]
Analyze structure using the spcc descriptor
  > as name   :  create/show structure
  > as -name  :  edit structure
  > as ?      :  list all spcc in dir.spcc

[0xBFBEAA80]> as foo
# .. vi ~/.radare/spcc/foo.spcc
struct foo {
        int id;
        void *next;
        void *prev;
};

void parse(struct spcc *spcc, uchar *buffer) {
        struct foo tmp;
        memcpy(&tmp, buffer, sizeof(struct foo));
        printf("id: %d\nnext: %p\nprev: %p\n",
                tmp.id, tmp.next, tmp.prev);
}
~                                                                                                                               
~         
[0xBFBEAA80]> as foo
id: 1
next: 0xbfbeb7e4
prev: (nil)