struct _IO_FILE {

  int _flags;       /* 高位字为_IO_MAGIC；剩下的就是旗帜。 */

#define _IO_file_flags _flags

  /* 以下指针对应于 C++ Streambuf 协议。 */

  /* 注意：Tk 直接使用 _IO_read_ptr 和 _IO_read_end 字段。 */

  char* _IO_read_ptr;   /* Current read pointer */

  char* _IO_read_end;   /* End of get area. */

  char* _IO_read_base;  /* Start of putback+get area. */

  char* _IO_write_base; /* Start of put area. */

  char* _IO_write_ptr;  /* Current put pointer. */

  char* _IO_write_end;  /* End of put area. */

  char* _IO_buf_base;   /* Start of reserve area. */

  char* _IO_buf_end;    /* End of reserve area. */

  /* The following fields are used to support backing up and undo. */

  char *_IO_save_base; /* Pointer to start of non-current get area. */

  char *_IO_backup_base;  /* Pointer to first valid character of backup area */

  char *_IO_save_end; /* Pointer to end of non-current get area. */

  struct _IO_marker *_markers;

  struct _IO_FILE *_chain;

  int _fileno;

#if 0

  int _blksize;

#else

  int _flags2;

#endif

  _IO_off_t _old_offset; /* This used to be _offset but it's too small.  */

#define __HAVE_COLUMN /* temporary */

  /* 1+column number of pbase(); 0 is unknown. */

  unsigned short _cur_column;

  signed char _vtable_offset;

  char _shortbuf[1];

  /*  char* _save_gptr;  char* _save_egptr; */

  _IO_lock_t *_lock;

#ifdef _IO_USE_OLD_IO_FILE

};

struct _IO_FILE_plus

{

    _IO_FILE    file;

    IO_jump_t   *vtable;

}

//32 位下的偏移是 0x94，而 64 位下偏移是 0xd8

void * funcs[] = {

   1 NULL, // "extra word"

   2 NULL, // DUMMY

   3 exit, // finish

   4 NULL, // overflow

   5 NULL, // underflow

   6 NULL, // uflow

   7 NULL, // pbackfail

   8 NULL, // xsputn  #printf

   9 NULL, // xsgetn

   10 NULL, // seekoff

   11 NULL, // seekpos

   12 NULL, // setbuf

   13 NULL, // sync

   14 NULL, // doallocate

   15 NULL, // read

   16 NULL, // write

   17 NULL, // seek

   18 pwn,  // close

   19 NULL, // stat

   20 NULL, // showmanyc

   21 NULL, // imbue

};

pwndbg> p _IO_file_jumps

$12 = {

  __dummy = 0,

  __dummy2 = 0,

  __finish = 0x7ffff78799d0 <_IO_new_file_finish>,

  __overflow = 0x7ffff787a740 <_IO_new_file_overflow>,

  __underflow = 0x7ffff787a4b0 <_IO_new_file_underflow>,

  __uflow = 0x7ffff787b610 <__GI__IO_default_uflow>,

  __pbackfail = 0x7ffff787c990 <__GI__IO_default_pbackfail>,

  __xsputn = 0x7ffff78791f0 <_IO_new_file_xsputn>,

  __xsgetn = 0x7ffff7878ed0 <__GI__IO_file_xsgetn>,

  __seekoff = 0x7ffff78784d0 <_IO_new_file_seekoff>,

  __seekpos = 0x7ffff787ba10 <_IO_default_seekpos>,

  __setbuf = 0x7ffff7878440 <_IO_new_file_setbuf>,

  __sync = 0x7ffff7878380 <_IO_new_file_sync>,

  __doallocate = 0x7ffff786d190 <__GI__IO_file_doallocate>,

  __read = 0x7ffff78791b0 <__GI__IO_file_read>,

  __write = 0x7ffff7878b80 <_IO_new_file_write>,

  __seek = 0x7ffff7878980 <__GI__IO_file_seek>,

  __close = 0x7ffff7878350 <__GI__IO_file_close>,

  __stat = 0x7ffff7878b70 <__GI__IO_file_stat>,

  __showmanyc = 0x7ffff787cb00 <_IO_default_showmanyc>,

  __imbue = 0x7ffff787cb10 <_IO_default_imbue>

}

>

    struct _IO_jump_t

{

    JUMP_FIELD(size_t, __dummy);

    JUMP_FIELD(size_t, __dummy2);

    JUMP_FIELD(_IO_finish_t, __finish);

    JUMP_FIELD(_IO_overflow_t, __overflow);

    JUMP_FIELD(_IO_underflow_t, __underflow);

    JUMP_FIELD(_IO_underflow_t, __uflow);

    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);

    /* showmany */

    JUMP_FIELD(_IO_xsputn_t, __xsputn);

    JUMP_FIELD(_IO_xsgetn_t, __xsgetn);

    JUMP_FIELD(_IO_seekoff_t, __seekoff);

    JUMP_FIELD(_IO_seekpos_t, __seekpos);

    JUMP_FIELD(_IO_setbuf_t, __setbuf);

    JUMP_FIELD(_IO_sync_t, __sync);

    JUMP_FIELD(_IO_doallocate_t, __doallocate);

    JUMP_FIELD(_IO_read_t, __read);

    JUMP_FIELD(_IO_write_t, __write);

    JUMP_FIELD(_IO_seek_t, __seek);

    JUMP_FIELD(_IO_close_t, __close);

    JUMP_FIELD(_IO_stat_t, __stat);

    JUMP_FIELD(_IO_showmanyc_t, __showmanyc);

    JUMP_FIELD(_IO_imbue_t, __imbue);

#if 0

    get_column;

    set_column;

#endif

};