2

tl;dr I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions. I can get the offset of the members, but I can't modify them due to the aforementioned error.


I have a the following structure in IDA:

LOAD:86B70B00 22 F6 DC 86 24 F6 DC+stru_86B70B00   Commands_Array <asc_86DCF622, aQueryOrSetAnSR,          2, \
LOAD:86B70B00 86 02 00 00 00 89 F6+                                        ; DATA XREF: sub_85C73BBC+42o
LOAD:86B70B00 D2 85 DF F6 D2 85 00+                                        ; LOAD:off_85C73D78o
LOAD:86B70B00 00 00 00 00 00 00 00+                                           sub_85D2F688+1, sub_85D2F6DE+1>; 0 ; "S" ...
LOAD:86B70B00 3F F6 DC 86 45 F6 DC+                Commands_Array <0, 0, 0x86DCF63F, Byte_Nothing, sub_0+2>; 1
LOAD:86B70B00 86 02 00 00 00 00 00+                Commands_Array <0, 0,          0, sub_0, asc_86DCF646>; 2
LOAD:86B70B00 00 00 00 00 00 00 00+                Commands_Array <aDial, sub_0+3, 0x85CAECA9, sub_85CAECAC+1,\
LOAD:86B70B00 00 00 00 00 00 00 00+                                           a_end__2>; 3

I would like to iterate over it and change the name of each of its members by examining each member.

Getting the offset to the structure member was sort of easy,

id = GetStrucIdbyName(struct_name)
print "0x%08x" % (((base + (struct_size * indx)) + GetMemberOffset(id, "Func")))

however, whenever I try to

MakeName(offset, new_name)

I get the following error:

can't rename byte as 'Func' because this byte can't have a name (it is a tail byte).

I guess I'm doing something wrong here, but I can't seem to find the "right" way to access IDA structures and handle them properly.

Help would be appreciated and compensated by points, beer and RE-SE fame.

2

I am not sure what you are trying to accomplish. My guess is you are trying to document each command entry in a list of commands.

Changing struct membernames is done in the structs view, or using the idc function SetMemberName. That will change the member name for all instances of the struct.

If you would like to do this programatically for all Members using something like this in idc script ( untested ):

sid = GetStrucIdByName("Commands_Array");
for (sofs = GetFirstMember(sid) ; sofs<=GetLastMember(sid) ; sofs += GetMemberSize(sid, sofs)) {
     SetMemberName(sid, sofs, "yournewname");
}

But maybe you are trying to give names to entries in an array of structs? In that case, uncheck the Create as array checkbox in the array properties. Then you will be able to assign names to each item in the array of structs.

Or maybe you are just looking for the expanded view of the struct? That may be accomplished by typing ctrl +, or unhide in the view menu.

What is not possible, is assign names, or comments to individual items in an array. You can add a repeatable comment to a struct member, which will than be the same for each struct in the array.

Or do you want to change the values in the structs? For that you would use functions like PatchByte.

EDIT:

I think i know what you want to do: You want to rename the subs in the struct. Not the struct membernames themselves.

MakeName(Dword(ofs))
  • Yup, I've already solved it and started writing a brief answer here. I'll post it in a few days. – Shift Jun 8 '17 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.