1

I have just started teaching myself IDA and I have had some trouble with an array of structs.

I have found and defined a struct similar to this: (simplified)

struct {
char filename[50];
int field2;
int field3;
}

I then found an array of these.

So I defined the struct, and then the array.

Before I defined them, the filename showed as a comment wherever it was referenced in the code.

Now however, it only references the first element of the array and an offset. So now looking through the code, I don't have comments with the file being referenced, which makes it hard to tell what file the code is working on.

Is there a way for me to keep the array of structs and the comments, or do I need to undefine the array & struct to get the comment with filename back?

EDIT: I forgot to add, the filenames also no longer show up in the strings window after I created the array of structs

EDIT 2: Here is my struct definition

000000 file_data_struct_t struc ; (sizeof=0x4F)
00000000 base_file_path  db 18 dup(?)            ; string(C)
00000012 unknown         db 44 dup(?)
0000003E loaded_data_ptr dd ?                    ; offset
00000042 ptr2            dd ?                    ; offset
00000046 file_length     db ?
00000047 unknown3        db ?
00000048 unknown4        db ?
00000049 unknown5        db ?
0000004A use_2nd_func    db 4 dup(?)
0000004E flag            db ?
0000004F file_data_struct_t end

This is for the game Theme Park

  • Can you paste your IDA struct definition? – Jason Geffner Sep 29 '15 at 0:36
  • I added my current structure definition, let me know if anything else would be helpful. Thanks. – Nathan Williams Sep 29 '15 at 2:03
0

Press * and uncheck 'Create as array'. This will convert the array into separate structs, and you'll see the strings again.

  • I just tried that and the filename is still not present in the strings view or as a comment. It does at least give it an individual label though, which I can find references to. – Nathan Williams Sep 29 '15 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.