how about using dynamic analysis for structures recovering?
like https://github.com/ampotos/dynStruct
use dynamorio/pintools to get more info.