1

I have a problem using IDA SDK function del_struc_member(struc_t *sptr, ea_t offset) ,

If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and it doesn't shrink it.

If i use another function from SDK, expand_struc(struc_t *sptr, ea_t offset, adiff_t delta, bool recalc=true); like so expand_struc(struc, 4, -4, true);

It does delete the member and shrink it, but it deletes other gap's that goes after (that are needed)plus it change the type of other members , for example:

before:

  int field_1204;
  _BYTE gap4B8[4];
  int field_1212;

after:

  int field_1204;
  __declspec(align(8)) int field_1212;

If i delete member manually by CTRL+E, it does shrink and doesn't create this problems with removing gap's.

What is correct way of removing a struct member and shrinking it ? P.S. Maybe i should set new type for all other gap's that are correct and only after that remove the member i don't need and shrink the struct . Or it would create same problems if its array ?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.