Timeline for How to apply IDA structure to a pointer of a structure
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 3, 2016 at 14:59 | vote | accept | vincentleest | ||
| Sep 12, 2016 at 0:34 | answer | added | NirIzr | timeline score: 8 | |
| Sep 12, 2016 at 0:08 | history | edited | NirIzr | CC BY-SA 3.0 |
added 30 characters in body
|
| Apr 20, 2016 at 18:34 | history | tweeted | twitter.com/StackReverseEng/status/722855864659505152 | ||
| Jan 11, 2016 at 17:38 | comment | added | user1354557 |
To add to @GuntramBlohm's comment: You can also select an area of text and hit t. A different menu will appear which will allow you to select a register (choose ebp) and a structure (choose custom_struct) and it will convert each offset from ebp within the selection to an offset of custom_struct. This works best in the linear view.
|
|
| Aug 1, 2015 at 22:05 | comment | added | tmr232 |
You can also try and use my Autostruct plugin. It allows to use Shift + T to convert multiple offsets at once instead of doing it line be line. Docs are here, code is available here. I've not tested in on 6.3, but it should work and save some time.
|
|
| Jul 29, 2015 at 15:13 | comment | added | Jason Geffner | @GuntramBlohm, want to create a new answer to this from your comment and mine? I'm happy for you to get the full credit for this one ;) | |
| Jul 29, 2015 at 14:38 | history | edited | vincentleest | CC BY-SA 3.0 |
added 19 characters in body
|
| Jul 29, 2015 at 14:37 | comment | added | vincentleest |
@JasonGeffner and @GuntramBlohm thank you both for your responses. After applying the "T" operation, IDA did not complain. However, the custom structure is still not showing up. I then realized that I gave ebp register a custom name. The custom_struct showed up after I've removed the custom name for the register.
|
|
| Jul 29, 2015 at 8:41 | comment | added | Guntram Blohm |
You can't tell IDA "ebp is a structure pointer" and have every instruction that uses ebp use the structure automatically. You'll have to right-click each of the offsets, select "Structure offset" from the context menu, then select your custom_struct field. (Or, as a shortcut, use the T key).
|
|
| Jul 29, 2015 at 0:39 | comment | added | Jason Geffner |
And are you editing the operand type for each mov [ebp+...], ... instruction as described in hex-rays.com/products/ida/support/tutorials/structs.shtml?
|
|
| Jul 28, 2015 at 22:09 | history | edited | vincentleest | CC BY-SA 3.0 |
added 60 characters in body
|
| Jul 28, 2015 at 22:08 | comment | added | vincentleest |
applying the structure to ebp.
|
|
| Jul 28, 2015 at 21:47 | comment | added | Jason Geffner | "but it is not working" -- what's "not working"? | |
| Jul 28, 2015 at 20:21 | review | First posts | |||
| Jul 28, 2015 at 20:51 | |||||
| Jul 28, 2015 at 20:19 | history | asked | vincentleest | CC BY-SA 3.0 |