How do you set registers as structs within a function in IDA?

Question

For example, in the following disassembly:

.text:007C6834 014                 mov     eax, [esi+4]
.text:007C6837 014                 mov     dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::`vftable'

How would I be able to set the type of the esi register to a struct, so that in an ideal world the disassembly would turn into:

.text:007C6834 014                 mov     eax, [esi.field_04]
.text:007C6837 014                 mov     dword ptr [esi.vtable], offset ??_7CAvatar@@6B@ ; const CAvatar::`vftable'

Answer 1

1. Create a struct

2. Apply the struct in one the four ways:

   • use the T hotkey.
   • Right-click the operand and choose the struct from "Structure offset" submenu.
   • menu Edit|Operand types|Offset|Offset (struct)
   • use the corresponding button on the Operand Type toolbar

Here's a short tutorial: https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml

Answer 2

Igor is right on, here are a few additional tips I have to offer.

Make sure when declaring variables within your structure, that you are accurately accommodating for the size of the variable. For example, is it a DWORD or some other multibyte buffer (maybe a memset/memcpy can give you a clue on its size here in these cases)?

Accurately accounting for these kinds of things is important when dealing with structures with many objects. It can help with your overall understanding of how it is used within the program, as well as further defining structure members

Also, keep in mind you can name the fields as you normally would any other variable in IDA. To be thorough, you can also declare the field type in the structure tab, to do this, right-click the field, then select field type.

Finally, when declaring the size of a multibyte array within a structure for example, you can actually do so in hex by just pre-pending '0x' in the array size field. Doesn't seem like much but it's a small tip that can come in handy.

There is so much more to explore concerning structures and their use within IDA. If you are looking to learn more about this and IDA in general, then I would highly recommend Chris Eagle's IDA Pro Book.

http://www.idabook.com/