2

I've made a very trivial C program which throws a struct on the heap and then diassembled it. Surprisingly, IDA Pro actually identified the struct as soon as I added it by name using the Structures tab. However, when I try to label the struct in the disassembly code, it only gives me the option of parsing the first member, even for subsequent members. In this example, the first structure member is called name and the second, age, third hair_color. But as you see in screenshot 2, I've already labeled the first member of the struct, but when I try to use the T hotkey to label the age and hair_color, it only gives me the option to keep labeling everything as PERSON.name. Why is this and how can I properly label these members?

To be more specific: I would expect to label the first member as "name" and have IDA automatically label the remaining members properly due to their offsets in relation to "name"/the beginning of the PERSON struct.

Struct def struct in code

  • where is the cursor on screenshot 2? – Igor Skochinsky Feb 21 '18 at 8:46
  • @IgorSkochinsky mov dword ptr [eax], 776.... However, I tried on ALL lines using this struct and same thing. – the_endian Feb 22 '18 at 2:31
2

IDA picks up a potential struct member offset from the operand on which your cursor is. If it's [eax], the offset is 0, so it shows the member at 0 ( .name). But if you try for example [eax+34h], it will suggest .age which is at offset 34.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.