Answer by Wizz for Inspecting memory values

I hope I get this straight:

You look at 0x3bc2060 and the next 0x8b8 bytes/octets. To reverse engineer a struct like this it is crucial to observe the program using this struct by filling it with values for the different fields in it.

Then you can deduce from many dumps starting at 0x3bc2060 and the following 0x8b8 bytes what is happening.

But it is not so precise as you might expect, because some fields are apparently not assignable. These are the char unknown[].

Doing a struct reverse is a very tedious task and you need much patience with your debugger ;)

Hope this helps to understand how it works in principle