6

I defined a struct in a header file, similar to this one:

struct STRUCT
{
    char a;
    int b;
};

This is parsed successfully by IDA, however it adds padding bytes after the char:

00000000 STRUCT          struc ; (sizeof=0x4)
00000000 a               db ?
00000001                 db ? ; undefined
00000002 b               dw ?
00000004 STRUCT          ends

I can't remove the padding field using u, so the question is: How can one remove padding fields automatically inserted by IDA, or how can one prevent IDA from creating padding fields?

9

You can use #pragma pack(1) before the declaration.

  • How can I undo this if I define multiple structs per file? #pragma pack(0)? Does this syntax originate from MSVC? – heinrich5991 May 17 '13 at 13:44
  • 4
    #pragma pack(push, 1) / #pragma pack(pop) – Igor Skochinsky May 17 '13 at 15:11
  • Worth noting, that if you did wish a member of your struct to be padded, you can define it thus: __declspec(align(4)) char; – Orwellophile Aug 20 '16 at 9:49
8

removing undefined byte

click on an undefined padding byte, then with Shrink struct (right-click menu, or Ctrl-S), choose how many bytes you want to remove - it automatically sets the right amount to the next defined offset.

preventing auto add

It depends on the parameter in the Options/Compiler menu: Change the default alignment to 1 to remove padding, then import your header

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.