2

In Ollydbg's hex dump window (lower left quadrant of CPU window) one can interpret data as structures, you can right-click on one or more bytes and see the options "Decode as structure" or "Decode as pointer to structure" (if more than one byte selected). It then opens a new window with the data laid out vertically, with each data element shown as a row. You can decode more than one instance.

However, I'd like to add my own structure types. Imagine I have this structure:

typedef struct {
           double x,y,z;   
           unsigned char id;
           int label;
           char *name_string;
           anotherStructType *struct;       
           } model_type;

Below are some images showing the steps, with the fixed structure type "COORD" chosen. Imagine I want to decode it instead with the above 'model_type' structure type. Perhaps the answer lies in some command line or .ini manual setting?

Also, it would be nice if this could be used along with labels to identify struct elements in the disassembly window, for example [EAX+1C] could be interpreted as 'player.id' if one could somehow tell Olly EAX is the base pointer. But perhaps I'm getting carried away...

enter image description here

enter image description here enter image description here

2

BE AWARE what follows are undocumented stuff

create a file either named as [binary].arg or common.arg
the first name is applicable to only to the specific [binary]
the second name common.arg is applicable globally

paste this inside the file

STRUCT _MYSTRUCT
QWORD DOUBLE x
QWORD DOUBLE y
QWORD DOUBLE z
BYTE  CHAR  id
DWORD INT label
DWORD ASCII* name
DWORD INT* foo
END

drop the file in the folder where ollydbg resides.
_MYSTRUCT should be available in the drop down box now

STRUCT is a keyword
struct names need a leading underscore
the members are defined like
FIELDSIZE, TYPENAME , MEMBERNAME

valid FIELDSIZE are

  1. BYTE
  2. WORD
  3. THREE
  4. DWORD
  5. QWORD
  6. TBYTE

that correspond to sizes 1,2,3,4,8,16
TYEPNAMES are vast you should try and err
i have posted some which are common
Notice i have cast Your last Structure as INT* instead of anotherstruct*
for which you may need to add a custom type in the file
you can specify a repeat count with asterisk *

BYTE*48 BYTE somecrap  

somecrap is MemberName a string

END is a keyword denoting end of structure

some dummy src that use the structure from your Query compiled executed and screen shot below

src

#include <stdio.h>
#include <windows.h>
#pragma pack(1)
typedef struct _TESTY {
    int a;
    int b;
}Testy,*PTesty;
typedef struct _MYSTRUCT {
    double x,y,z;
    unsigned char id;
    int label;
    char *name;
    Testy *foo;
}MyStruct,*PMyStruct;

int main (void) {
    MyStruct blah;
    Testy arrgh;
    char *test = "hello do i know c ?";
    memset(&blah,0,sizeof(blah));
    blah.x=43.0;
    blah.y=76.34;
    blah.z=0.0;
    blah.id = 'a';
    blah.label = 54;
    blah.name = test;
    arrgh.a =45;
    arrgh.b =54000;
    blah.foo = &arrgh;
    printf("%f\n",blah.x);
    printf("%s\n",blah.name);
    printf("%d\n",blah.foo->b);
    return 0;   
}

executed

structy.exe
43.000000
hello do i know c ?
54000 

running with ollydbg

ollydbg.exe structy.exe 

the log windows shows it used the structure definitions we provided by xxxxx.arg

Log data
Address   Message
          OllyDbg v2.01
          Command line: structy.exe
          Loading function descriptions from 'common.arg'
            2 structures
            Total size of known data is 1521777 bytes

screen shot enter image description here

  • Looks good, thanks! But I can't repeat it in my system, the compiler is optimizing it away and I get a much shorter program with hardcoded values fed to _printf. I am using Visual Studio 6, compiling for Release with default flags. I need to find my correct compiler or linker setting to make the full code appear that you have. – Markbotix Feb 3 '16 at 6:32
  • i dont compile debug i always compile release and with highest level of warnings and analyze enabled code shown above is done with windows sdk 7.1 compiler (free ) cl /nologo /Zi /EHsc /O1 /analyze /W4 *.cpp /link /release so wyswyg should apply – blabb Feb 3 '16 at 10:31
  • I fixed the compiler optimization issue, changing it to /Od which is "disable (Debug)". The default for VS6 Release was /O2 ="optimize speed". It was simply under the Project Settings->C++ -> Optimizations in the IDE. I like the idea of doing things from the command line with 'cl' directly, I must try that too. – Markbotix Feb 3 '16 at 21:38
  • This is a great answer, now I can see structures. It's really useful I believe, at least for looking into my own programs. I found Blabb's answer worked with Ollydbg 2.01. I found I could change the .ARG file and simply restart (ctrl-F2) to reload the defn's without having to stop and start Ollydbg like I feared (I thought it might only look at them when I launched Ollydbg). Sadly in Olldbg when you spawn a structure, list, or other dump window from the main hex dump, it doesn't have the same capabiliites. I can't spawn another decoded window from the *foo pointer to the 2nd struct type. – Markbotix Feb 3 '16 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.