0

See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but if I right-click, there is no option to define a struct.enter image description here

  • What do you mean to define a struct ? you mean a C/C++ struct ? I see it stowed in Data Segment. – Abr001am Jan 16 '18 at 0:58
  • Yes a c style struct. Are you familiar with IDA Pro how you can press a key and define a c style struct and then apply it to offsets like that so that they are properly labeled – the_endian Jan 16 '18 at 1:00
1

Right now it is not possible to label instructions in the disassembly as structure members. It is however possible to define structs and visit them in memory (similar to 010 editor). The main sources of information about this are here and here.

As an example if you have the following code:

#pragma pack(1)
struct MyStruct
{
    int a;
    bool b;
    const char* c;
};

void test(MyStruct* p)
{
    MyStruct* s = p;
    s->a = 0x1234;
    s->b = true;
    s->c = "Hello world";
}

int main()
{
    MyStruct s;
    test(&s);
    return s.a;
}

You use the Parse header option in the Struct tab to parse the following header:

struct MyStruct
{
    int a;
    bool b;
    const char* c;
};

This will load the structure (use the command EnumTypes to see a list of types). Now when you're paused at the disassembly of the test function you can use the Visit type option from the Struct tab to show the contents of the memory at ecx in a structural way:

The addresses of the structure members will also be added as temporary labels so you can see what an instruction refers to in the info box:

This feature has not been further developed because there was a lack of interest from the community.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.