0

When a C++ subclass object is being passed to a function which accepts base class objects, the C++ compiler implementation is so the subclass object pointer gets shifted down to point to the corresponding virtual table. So, the object may be passed to a function starting from the offset of that virtual table.

I'm trying to find a way how to pass the pointer to an offset within an object to a function in IDA decompiled view.

I tried to set the type of the function argument something like struct->field * or struct.field * but that doesn't work.

  • Its not quite clear what you're asking here. Could you please elaborate? – NirIzr Apr 2 '17 at 7:58
  • On this page: hex-rays.com/products/decompiler/manual/cmd_numform.shtml you can find the following text: Please note that v2 must be declared as a pointer to the corresponding structure field, otherwise the conversion may fail. So, I just want to know how to declare a pointer to the structure field? – Igor Lebedev Apr 2 '17 at 17:56
1

In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the corresponding field in this parent struct as a pointer to the subtype.

The function argument type is irrelevant for this purpose, and should have the type of the substruct.

https://www.hex-rays.com/products/decompiler/manual/tricks.shtml#03

  • So, I can create a subtype and pass its pointer to the function. But in this case, I would need to do some tricks if the functions uses negative offsets. But is it possible to pass a structure field as a function argument? v2 must be declared as a pointer to the corresponding structure field how can this be achieved? – Igor Lebedev Apr 3 '17 at 14:37
  • The whole principle of the CONTAINING_RECORD macro is to use negative offset to actually get a reference to the parent structure. See the link I just added to my answer for more details. – Dillinur Apr 4 '17 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.