2026-03-06 18:14:43 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文档详细介绍了libev-4.33版本的源码目录结构，旨在辅助理解mettle后门工具的依赖库。文中清晰梳理了项目根目录文件，将核心源码划分为API层、实现层、平台后端层及兼容层，并说明了构建脚本与文档的功能。该文档为开发者快速定位核心逻辑文件和编译产物提供了准确导航，是深入研究libev库底层实现的重要参考基础。 综合评分： 70 文章分类： 逆向分析,安全工具,二进制安全

cover_image

libev库源码分析系列教程(十六)

原创

haidragon haidragon

安全狗的自我修养

2026年3月6日 12:12 湖南

源码分析mettle后门工具学习所使用的依赖库

官网：http://securitytech.cc

libev 源码目录结构说明

项目根目录结构

libev-4.33/
├── README &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 项目介绍和基本使用说明
├── autogen.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 自动生成configure脚本
├── ltmain.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# libtool主脚本
├── Makefile.am &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# automake配置文件
├── Makefile.in &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# configure生成的Makefile模板
├── configure.ac &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # autoconf配置脚本
├── config.h.in &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 配置头文件模板
├── ev.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 核心API声明和基础数据结构
├── ev.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 核心实现和主事件循环逻辑
├── ev_vars.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 全局变量声明宏定义
├── ev_wrap.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 多实例支持包装器
├── ev++.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # C++绑定接口
├── event.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# libevent兼容API
├── ev_select.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# select后端实现
├── ev_poll.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# poll后端实现
├── ev_epoll.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # epoll后端实现 (Linux)
├── ev_kqueue.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# kqueue后端实现 (BSD)
├── ev_port.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# event ports后端实现 (Solaris)
├── ev_win32.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Windows平台实现
├── ev_iouring.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Linux io_uring后端实现
├── ev_linuxaio.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Linux AIO后端实现
├── event.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# libevent兼容层实现
├── build_debug.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 标准debug编译脚本
├── build_simple.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 简化编译脚本
├── build_minimal.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 最小化编译脚本
├── run_example.sh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 测试程序运行脚本
├── example_usage.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# libev使用案例演示程序
├── test_simple.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 简单测试程序
├── README_DEBUG.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Debug编译使用指南
├── SUMMARY.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 项目完整总结
├── LIBEV_DESIGN_ANALYSIS.md &nbsp; &nbsp; &nbsp; &nbsp; # 设计思想与架构分析
├── LIBEV_SOURCE_CODE_ANALYSIS.md &nbsp; &nbsp;# 源码深度解析
├── LIBEV_SYSTEM_ARCHITECTURE.md &nbsp; &nbsp; # 系统架构全景图
├── build_simple/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 简化编译构建目录
│ &nbsp; ├── config.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 生成的配置文件
│ &nbsp; ├── libev.a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 编译生成的静态库
│ &nbsp; └── *.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 复制的头文件
├── build_minimal/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 最小化编译构建目录
│ &nbsp; ├── config.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 生成的配置文件
│ &nbsp; ├── libev.a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 编译生成的静态库
│ &nbsp; └── *.h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 复制的头文件
└── build_debug/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 标准debug编译构建目录
&nbsp; &nbsp; ├── config.log &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # configure日志
&nbsp; &nbsp; ├── config.status &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# configure状态
&nbsp; &nbsp; ├── Makefile &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 生成的Makefile
&nbsp; &nbsp; └── *.o &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 编译目标文件

核心源码文件功能分类

核心API层

ev.h

: 核心API声明、数据结构定义、宏定义
ev++.h

: C++绑定接口，提供面向对象的使用方式
event.h

: libevent兼容API，便于迁移现有代码

核心实现层

ev.c

: 事件循环核心逻辑、watcher管理、时间处理
ev_vars.h

: 全局变量声明的宏定义系统
ev_wrap.h

: 多事件循环实例支持的包装器

平台后端层

ev_select.c

: select系统调用后端实现
ev_poll.c

: poll系统调用后端实现
ev_epoll.c

: Linux epoll后端实现（高性能）
ev_kqueue.c

: BSD kqueue后端实现（功能丰富）
ev_port.c

: Solaris event ports后端实现
ev_win32.c

: Windows平台后端实现
ev_iouring.c

: Linux io_uring异步IO后端
ev_linuxaio.c

: Linux异步IO后端实现

兼容层

event.c

: libevent API兼容层实现

构建相关文件

自动化构建

autogen.sh

: 生成configure脚本的自动化工具
configure.ac

: autoconf配置脚本源文件
Makefile.am

: automake配置文件
ltmain.sh

: libtool主脚本文件

自定义构建脚本

build_debug.sh

: 标准debug编译脚本（使用autoconf）
build_simple.sh

: 简化编译脚本（直接编译源码）
build_minimal.sh

: 最小化编译脚本（推荐使用）
run_example.sh

: 测试程序编译运行脚本

示例和文档

示例程序

example_usage.c

: 完整功能演示程序
test_simple.c

: 简单功能测试程序

技术文档

README_DEBUG.md

: Debug编译和使用指南
SUMMARY.md

: 项目完整总结和快速入门
LIBEV_DESIGN_ANALYSIS.md

: 设计思想和架构模式分析
LIBEV_SOURCE_CODE_ANALYSIS.md

: 源码深度解析
LIBEV_SYSTEM_ARCHITECTURE.md

: 系统架构全景图

编译产物目录

build_simple/

简化编译生成的构建目录，包含：

config.h: 自动生成的配置文件
libev.a: 静态库文件
相关头文件副本

build_minimal/

最小化编译生成的构建目录，包含：

config.h: 自动生成的配置文件
libev.a: 静态库文件
相关头文件副本

build_debug/

标准autoconf编译生成的构建目录，包含：

configure生成的各种文件
编译目标文件(.o)
最终库文件

文档版本: v1.0 适用版本: libev 4.33 更新时间: 2026年3月1日

公众号:安全狗的自我修养
vx:2207344074
http://gitee.com/haidragon
http://github.com/haidragon
bilibili:haidragonx

#

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：安全狗的自我修养 haidragon haidragon《libev库源码分析系列教程(十六)》