10

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:

enter image description here

I was able to retype gpfnCommCtrlAPI into char*[14] which made it quite readable:

enter image description here

But then is it possible to retype g_pfnsUxCtrl, a pointer to an array of function pointers, (possibly with a custom enum) to make it a little bit more readable? Here's an example of how it looks now in case of g_pfnsUxCtrl[7]:

enter image description here

PS. To understand what index 7 refers to in that case I need to go back to the gpfnCommCtrlAPI array, which may not be immediately available where g_pfnsUxCtrl[7] is used.

PS2. In that case case, I manually renamed p_comctl32_HandleScrollCmd variable to make it more readable.

Improve this question
3
  • Which executable file did you analyse?
    – Biswapriyo
    Commented Apr 12, 2019 at 5:47
  • @Biswapriyo: comctrl32.dll x86 build from Win10.
    – c00000fd
    Commented Apr 12, 2019 at 7:22
  • that sounds like you want a typedef if you want X to mean g_pfnsUxCtrl[7] unless your want to use the enum to replace the 7
    – Simeon Pilgrim
    Commented Apr 24, 2019 at 2:19

1 Answer 1

Reset to default
3

you are able to add your own enum type inside Data Type Manager. (Keep in mind to select correct size).

enter image description here

enter image description here

enter image description here

Then you should be able to change the type to your newly created enum and everything should be nicely resolved.

Improve this answer
2
  • yeah, that's how you define a generic enum. But how would you apply it to the particular example I showed above?
    – c00000fd
    Commented Apr 23, 2019 at 20:41
  • if that proc list is relatively short with const count and you really would like custom names instead of integers, then you can create a custom type with lots of integers of different names. Then you'll have a single object with couple of variables and each of those will have a custom name. And if those addresses are constant which is kinda stupid but you can look where you land with that, you can try to set p_comct132_HandleScrollCmd to enumType and g_pfnsUxCtrl to pointer to enumType. Both solutions are silly, in your case I'd just memorize those integers
    – erexo
    Commented Apr 24, 2019 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.