In Ollydbg's hex dump window (lower left quadrant of CPU window) one can interpret data as structures, you can right-click on one or more bytes and see the options "Decode as structure" or "Decode as pointer to structure" (if more than one byte selected). It then opens a new window with the data laid out vertically, with each data element shown as a row. You can decode more than one instance.

However, I'd like to add my own structure types. Imagine I have this structure:

typedef struct {
           double x,y,z;   
           unsigned char id;
           int label;
           char *name_string;
           anotherStructType *struct;       
           } model_type;

Below are some images showing the steps, with the fixed structure type "COORD" chosen. Imagine I want to decode it instead with the above 'model_type' structure type. Perhaps the answer lies in some command line or .ini manual setting?

Also, it would be nice if this could be used along with labels to identify struct elements in the disassembly window, for example [EAX+1C] could be interpreted as 'player.id' if one could somehow tell Olly EAX is the base pointer. But perhaps I'm getting carried away...

enter image description here

enter image description here enter image description here

1 Answer 1


BE AWARE what follows are undocumented stuff

create a file either named as [binary].arg or common.arg
the first name is applicable to only to the specific [binary]
the second name common.arg is applicable globally

paste this inside the file


drop the file in the folder where ollydbg resides.
_MYSTRUCT should be available in the drop down box now

STRUCT is a keyword
struct names need a leading underscore
the members are defined like

valid FIELDSIZE are

  1. BYTE
  2. WORD
  3. THREE
  4. DWORD
  5. QWORD
  6. TBYTE

that correspond to sizes 1,2,3,4,8,16
TYEPNAMES are vast you should try and err
i have posted some which are common
Notice i have cast Your last Structure as INT* instead of anotherstruct*
for which you may need to add a custom type in the file
you can specify a repeat count with asterisk *

BYTE*48 BYTE somecrap  

somecrap is MemberName a string

END is a keyword denoting end of structure

some dummy src that use the structure from your Query compiled executed and screen shot below


#include <stdio.h>
#include <windows.h>
#pragma pack(1)
typedef struct _TESTY {
    int a;
    int b;
typedef struct _MYSTRUCT {
    double x,y,z;
    unsigned char id;
    int label;
    char *name;
    Testy *foo;

int main (void) {
    MyStruct blah;
    Testy arrgh;
    char *test = "hello do i know c ?";
    blah.id = 'a';
    blah.label = 54;
    blah.name = test;
    arrgh.a =45;
    arrgh.b =54000;
    blah.foo = &arrgh;
    return 0;   


hello do i know c ?

running with ollydbg

ollydbg.exe structy.exe 

the log windows shows it used the structure definitions we provided by xxxxx.arg

Log data
Address   Message
          OllyDbg v2.01
          Command line: structy.exe
          Loading function descriptions from 'common.arg'
            2 structures
            Total size of known data is 1521777 bytes

screen shot enter image description here

  • Looks good, thanks! But I can't repeat it in my system, the compiler is optimizing it away and I get a much shorter program with hardcoded values fed to _printf. I am using Visual Studio 6, compiling for Release with default flags. I need to find my correct compiler or linker setting to make the full code appear that you have.
    – Markbotix
    Commented Feb 3, 2016 at 6:32
  • i dont compile debug i always compile release and with highest level of warnings and analyze enabled code shown above is done with windows sdk 7.1 compiler (free ) cl /nologo /Zi /EHsc /O1 /analyze /W4 *.cpp /link /release so wyswyg should apply
    – blabb
    Commented Feb 3, 2016 at 10:31
  • I fixed the compiler optimization issue, changing it to /Od which is "disable (Debug)". The default for VS6 Release was /O2 ="optimize speed". It was simply under the Project Settings->C++ -> Optimizations in the IDE. I like the idea of doing things from the command line with 'cl' directly, I must try that too.
    – Markbotix
    Commented Feb 3, 2016 at 21:38
  • 1
    This is a great answer, now I can see structures. It's really useful I believe, at least for looking into my own programs. I found Blabb's answer worked with Ollydbg 2.01. I found I could change the .ARG file and simply restart (ctrl-F2) to reload the defn's without having to stop and start Ollydbg like I feared (I thought it might only look at them when I launched Ollydbg). Sadly in Olldbg when you spawn a structure, list, or other dump window from the main hex dump, it doesn't have the same capabiliites. I can't spawn another decoded window from the *foo pointer to the 2nd struct type.
    – Markbotix
    Commented Feb 3, 2016 at 21:42
  • Be aware that numbers are in hexadecimal by default. The 0x prefix is optional, but required for numbers starting with alpha characters. The . suffix can be used for unsigned decimal numbers: 10. Also TBYTE is 10 bytes in size (which is required for fields using the LDOUBLE type). But it was awkward to figure this out before learning everything was in hex. For character arrays, the ATEXT type can be used. I've written up more in-depth documentation on the format, there's a lot to it, but it's definitely experimental: github.com/trigger-segfault/Ollydbg-Argfile-Docs Commented Jul 20, 2021 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.