1

When a C++ subclass object is being passed to a function which accepts base class objects, the C++ compiler implementation is so the subclass object pointer gets shifted down to point to the corresponding virtual table. So, the object may be passed to a function starting from the offset of that virtual table.

I'm trying to find a way how to pass the pointer to an offset within an object to a function in IDA decompiled view.

I tried to set the type of the function argument something like struct->field * or struct.field * but that doesn't work.

Improve this question
2
  • Its not quite clear what you're asking here. Could you please elaborate?
    – NirIzr
    Commented Apr 2, 2017 at 7:58
  • On this page: hex-rays.com/products/decompiler/manual/cmd_numform.shtml you can find the following text: Please note that v2 must be declared as a pointer to the corresponding structure field, otherwise the conversion may fail. So, I just want to know how to declare a pointer to the structure field?
    – Igor Lebedev
    Commented Apr 2, 2017 at 17:56

1 Answer 1

Reset to default
2

In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the corresponding field in this parent struct as a pointer to the subtype.

The function argument type is irrelevant for this purpose, and should have the type of the substruct.

https://www.hex-rays.com/products/decompiler/manual/tricks.shtml#03

Improve this answer
2
  • So, I can create a subtype and pass its pointer to the function. But in this case, I would need to do some tricks if the functions uses negative offsets. But is it possible to pass a structure field as a function argument? v2 must be declared as a pointer to the corresponding structure field how can this be achieved?
    – Igor Lebedev
    Commented Apr 3, 2017 at 14:37
  • The whole principle of the CONTAINING_RECORD macro is to use negative offset to actually get a reference to the parent structure. See the link I just added to my answer for more details.
    – user2823000
    Commented Apr 4, 2017 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.