Creating my own custom structure in Ollydbg

Question

In Ollydbg's hex dump window (lower left quadrant of CPU window) one can interpret data as structures, you can right-click on one or more bytes and see the options "Decode as structure" or "Decode as pointer to structure" (if more than one byte selected). It then opens a new window with the data laid out vertically, with each data element shown as a row. You can decode more than one instance.

However, I'd like to add my own structure types. Imagine I have this structure:

typedef struct {
           double x,y,z;   
           unsigned char id;
           int label;
           char *name_string;
           anotherStructType *struct;       
           } model_type;

Below are some images showing the steps, with the fixed structure type "COORD" chosen. Imagine I want to decode it instead with the above 'model_type' structure type. Perhaps the answer lies in some command line or .ini manual setting?

Also, it would be nice if this could be used along with labels to identify struct elements in the disassembly window, for example [EAX+1C] could be interpreted as 'player.id' if one could somehow tell Olly EAX is the base pointer. But perhaps I'm getting carried away...

Answer 1

BE AWARE what follows are undocumented stuff

create a file either named as [binary].arg or common.arg
the first name is applicable to only to the specific [binary]
the second name common.arg is applicable globally

paste this inside the file

STRUCT _MYSTRUCT
QWORD DOUBLE x
QWORD DOUBLE y
QWORD DOUBLE z
BYTE  CHAR  id
DWORD INT label
DWORD ASCII* name
DWORD INT* foo
END

drop the file in the folder where ollydbg resides.
_MYSTRUCT should be available in the drop down box now

STRUCT is a keyword
struct names need a leading underscore
the members are defined like
FIELDSIZE, TYPENAME , MEMBERNAME

valid FIELDSIZE are

1. BYTE
2. WORD
3. THREE
4. DWORD
5. QWORD
6. TBYTE

that correspond to sizes 1,2,3,4,8,16
TYEPNAMES are vast you should try and err
i have posted some which are common
Notice i have cast Your last Structure as INT* instead of anotherstruct*
for which you may need to add a custom type in the file
you can specify a repeat count with asterisk *

BYTE*48 BYTE somecrap  

somecrap is MemberName a string

END is a keyword denoting end of structure

some dummy src that use the structure from your Query compiled executed and screen shot below

src

#include <stdio.h>
#include <windows.h>
#pragma pack(1)
typedef struct _TESTY {
    int a;
    int b;
}Testy,*PTesty;
typedef struct _MYSTRUCT {
    double x,y,z;
    unsigned char id;
    int label;
    char *name;
    Testy *foo;
}MyStruct,*PMyStruct;

int main (void) {
    MyStruct blah;
    Testy arrgh;
    char *test = "hello do i know c ?";
    memset(&blah,0,sizeof(blah));
    blah.x=43.0;
    blah.y=76.34;
    blah.z=0.0;
    blah.id = 'a';
    blah.label = 54;
    blah.name = test;
    arrgh.a =45;
    arrgh.b =54000;
    blah.foo = &arrgh;
    printf("%f\n",blah.x);
    printf("%s\n",blah.name);
    printf("%d\n",blah.foo->b);
    return 0;   
}

executed

structy.exe
43.000000
hello do i know c ?
54000 

running with ollydbg

ollydbg.exe structy.exe 

the log windows shows it used the structure definitions we provided by xxxxx.arg

Log data
Address   Message
          OllyDbg v2.01
          Command line: structy.exe
          Loading function descriptions from 'common.arg'
            2 structures
            Total size of known data is 1521777 bytes

screen shot