0

I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra?

16          | Size of array is 0x16 
00 
00 
04
00 00 00 00
10 08 0a 04
...
dc c1 50 08 |
74 cf 50 08 | Array of size 0x16
14 dd 50 08 |
(.........) |
  • I think you would want to just define a size field (of type uint or whatever) and an array field (of type pointer to whatever type). – genghiskhan May 1 at 23:28
  • Do you mean variable size? type[0]? For some reason, Ghidra doesn't allow me to do that. – Alex Osheter May 2 at 10:03
  • I don't think you're able to declare an array with variable size. What is the definition of the struct? I don't think you're able to declare a variable-sized array in C. The compiler wouldn't know how many bytes to allocated for it. That's why there is a length field, to let the programmer know how many elements are in the array which would most likely be malloc'd – genghiskhan May 2 at 14:34
0

Ghidra flexible arrays support what you are trying to do. From Ghidra help (search for "flexible array"):

A flexible array is added to the end of a structure by adding a last row specified by the base DataType (e.g. char) then invoking the array action and specifying an element count of 0.

So you can't create a flexible array in 1 step. Enter the data type for the variable-length structure member first. Then select the row for that new structure member and press the [ key to invoke the array action. Entering 0 as the element count in the resulting dialog will create a flexible array.

Ghidra flexible arrays have limited functionality. From Ghidra help:

The use of flexible array components is not currently reflected in decompiler results or listing reference markup. Its primary purpose if to reflect the C/C++ source definition of a structure with correct alignment and structure sizing.

While C/C++ support flexible arrays anywhere within a structure, Ghidra only supports the case where it is the last structure component.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.