Skip to main content
added 30 characters in body
Source Link
NirIzr
  • 11.8k
  • 1
  • 38
  • 87

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencentsubsequent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct toin ebp
push    esi
push    edi
xor     ebx, ebx

and, not too far from above..., I see it being populated:

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'mI'm having trouble with applying this custom structure to this pointer. I'veI've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

UsingI'm using IDA Pro 6.3

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

Using IDA Pro 6.3

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct in ebp
push    esi
push    edi
xor     ebx, ebx

and, not too far from above, I see it being populated:

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now I'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I'm using IDA Pro 6.3

Tweeted twitter.com/StackReverseEng/status/722855864659505152
added 19 characters in body
Source Link

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

Using IDA Pro 6.3

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

Using IDA Pro 6.3

added 60 characters in body
Source Link

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working.

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequencent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct to ebp
push    esi
push    edi
xor     ebx, ebx

not too far from above...

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now i'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14
Source Link
Loading