1

I have a problem using IDA SDK function del_struc_member(struc_t *sptr, ea_t offset) ,

If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and it doesn't shrink it.

If i use another function from SDK, expand_struc(struc_t *sptr, ea_t offset, adiff_t delta, bool recalc=true); like so expand_struc(struc, 4, -4, true);

It does delete the member and shrink it, but it deletes other gap's that goes after (that are needed)plus it change the type of other members , for example:

before:

  int field_1204;
  _BYTE gap4B8[4];
  int field_1212;

after:

  int field_1204;
  __declspec(align(8)) int field_1212;

If i delete member manually by CTRL+E, it does shrink and doesn't create this problems with removing gap's.

What is correct way of removing a struct member and shrinking it ? P.S. Maybe i should set new type for all other gap's that are correct and only after that remove the member i don't need and shrink the struct . Or it would create same problems if its array ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.