1

Is there any kind of IDAPython/IDC function, i.e. a programmatic method, that allows you to simulate this?

Structures -> Insert -> Add standard structure

2 Answers 2

2

For enums you can use the AddEnum(idx, name, flag) function to create an enum inside an IDC script or Python script. This returns an enum_id which you can then use to create symbolic constant using AddConstEx(enum_id, name, value, bmask).

After this you can then get the constant for the enum using the same enum_id GetConstEx(enum_id, value, serial, bmask). This will return a const_id which can be used to set a repeatable comment for that value in the enum using SetConstCmt(const_id, cmt, repeatable).

A short example of using this all together can be seen in this script I use;

def create_enum(enum_name, member_infos, offset, increment):
   return_id = AddEnum(-1, enum_name, 0x1100000);

    if return_id == BADADDR:
        error('Unable to create enum : %s' % enum_name)
        return return_id

    for member_info in member_infos:
        debug("Attempting to create enum member and comment : %s.%s -> %s" % (enum_name, member_info[0], member_info[1]))

        if AddConstEx(return_id, member_info[0], offset, -1) == 0:
            const_id = GetConstEx(return_id, offset, 0, -1)

            if const_id == -1:
                debug('Unable to get constant id for : %s.%s' % (enum_name, member_info[0]))

            else:
                if SetConstCmt(const_id, member_info[1], 1):
                    debug('Enum value created : %s.%s' % (enum_name, member_info[0]))

                else:
                    error('Enum value failed to have comment set : %s.%s' % (enum_name, member_info[0]))

                offset += increment
        else:
            error('Unable to create enum member : %s.%s' % (enum_name, member_info[0]))
            return -1

    info('Finished creating enum : %s' % enum_name)
    return return_id

This would be used as follows;

enum_to_create = [
    ('enum_1', 'enum1 comment'),
    ('enum_2', 'enum2 comment'),
    ('enum_3', 'enum3 comment'),
    ('enum_4', 'enum4 comment'),
    ('enum_5', 'enum5 comment')
]

create_enum('enum propername', enum_to_create, -0x8, 0x4)

As for the structures, it would appear you would go a similar route though using the structure commands like AddStructEx(index, name, is_union) and SetStrucName(sid, name), etc.

2
  • 1
    Thanks for your post. The goal was to get a struct from a type library, meaning that we don't require to add the fields of a struct since we loaded it. Anyway, it would be useful for sure to anyone who wants to work with structs/enums :)!
    – Shaddy
    Commented Oct 12, 2015 at 10:30
  • Fair enough. Didn't realize you had the library available - I almost never do :)
    – diff
    Commented Oct 13, 2015 at 16:22
2

The modern counterparts of the functions from the original answer below are called:


I found the solution using Til2Idb

LoadTil("type_library_name") #example: mssdk
Til2Idb(-1, "YOUR_STRUCT_NAME_HERE") # example: IMAGE_OPTIONAL_HEADER

The first parameter is used if you want it in a specific position of your structures list. "-1" means the end of the list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.