如何编译cuckoosandbox的监视器？

Question

我在win10（64bit）cygwin上编译监视器，使用i686-w64-mingw32-gcc-4.8.0-win64_rubenvb和x86_64-w64-mingw32-gcc-4.8.0-win64_rubenvb，

错误是：

src/hooking.c:908:5: error: unknown type name 'IMAGE_DELAYLOAD_DESCRIPTOR'
     IMAGE_DELAYLOAD_DESCRIPTOR *did = NULL;
     ^
src/hooking.c:939:25: error: 'IMAGE_DELAYLOAD_DESCRIPTOR' undeclared (first use in this function)
                 did = *(IMAGE_DELAYLOAD_DESCRIPTOR **)(target + 1);
                         ^
src/hooking.c:939:25: note: each undeclared identifier is reported only once for each function it appears in
src/hooking.c:939:54: error: expected expression before ')' token
                 did = *(IMAGE_DELAYLOAD_DESCRIPTOR **)(target + 1);
                                                      ^
src/hooking.c:953:66: error: request for member 'DllNameRVA' in something not a structure or union
         library_from_asciiz((const char *) h->module_handle + did->DllNameRVA,
                                                                  ^
make: *** [Makefile:80：objects/x86/src/hooking.o] 错误 1

我在winnt.h和delayimp.h中搜索IMAGE_DELAYLOAD_DESCRIPTOR，但没有IMAGE_DELAYLOAD_DESCRIPTOR。

我应该使用x86_64-w64-mingw32-gcc- 4.9.0 -win64_rubenvb或x86_64-w64-mingw32-gcc- 4.9.1 -win64_rubenvb或其他版本？

Answer 1

请再看winnt.h。 typedef struct _IMAGE_DELAYLOAD_DESCRIPTOR { union { DWORD AllAttributes; struct { DWORD RvaBased:1; DWORD ReservedAttributes:31; } DUMMYSTRUCTNAME; } Attributes; DWORD DllNameRVA; DWORD ModuleHandleRVA; DWORD ImportAddressTableRVA; DWORD ImportNameTableRVA; DWORD BoundImportAddressTableRVA; DWORD UnloadInformationTableRVA; DWORD TimeDateStamp; } IMAGE_DELAYLOAD_DESCRIPTOR, *PIMAGE_DELAYLOAD_DESCRIPTOR; 肯定是在那里定义的，具有以下结构：

unsigned char data[]

祝你好运。