0

In the following function foo

.text:0000000000401110 foo             proc near
.text:0000000000401110
.text:0000000000401110 var_8           = qword ptr -8
.text:0000000000401110
.text:0000000000401110                 push    rbp
.text:0000000000401111                 mov     rbp, rsp
.text:0000000000401114                 mov     [rbp+var_8], rdi
.text:0000000000401118                 mov     rax, [rbp+var_8]
.text:000000000040111C                 mov     ecx, [rax]
.text:000000000040111E                 mov     rax, [rbp+var_8]
.text:0000000000401122                 add     ecx, [rax+4]
.text:0000000000401125                 movsxd  rax, ecx
.text:0000000000401128                 mov     rdx, [rbp+var_8]
.text:000000000040112C                 add     rax, [rdx+8]
.text:0000000000401130                 pop     rbp
.text:0000000000401131                 retn
.text:0000000000401131 foo             endp

which is actually

struct S {
    int a;
    int b;
    long long c;
};

int foo(struct S *s) {
    return s->a + s->b + s->c;
}

I've defined the struct S in IDA (via Shift-F9/Ins...), how can I specify that rdi is the pointer to the base of the struct, so that the disassembly becomes something like this

...
.text:0000000000401118                 mov     rax, [rbp+var_8]
.text:000000000040111C                 mov     ecx, [p0.a]
.text:000000000040111E                 mov     rax, [rbp+var_8]
.text:0000000000401122                 add     ecx, [p0.b]
.text:0000000000401125                 movsxd  rax, ecx
.text:0000000000401128                 mov     rdx, [rbp+var_8]
.text:000000000040112C                 add     rax, [p0.c]
...

There is a similar question but it applies for the case where, for example rbx is the base pointer and fields are accessed via [rbx+offset]. In my case, rdi is the base pointer but fields are not accessed via [rdi+offset].

1

Since you code seems to be un-optimized, you have to manually follow the memory access manually. In your case, you have to apply this structure offset (T) at 0x000000000040111C (rax), 0x0000000000401122 (rax) and 0x000000000040112C (rdx). AFAIK, there's no easy way to define a local variable as a pointer to a structure and automatically show reference to the structure. Unless you are working with hexrays decompiler.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.