I'm reversing a Delphi program and have a part where it says:
Result = *(Self - 44);
But I want it to say something like:
Result = *(Self - offsetof(VMT_ClassDefinition, vmtClassName));
Being VMT_ClassDefinition the following struct:
struct VMT_ClassDefinition {
Cardinal vmtSelfPtr;
Cardinal vmtIntfTable;
Cardinal vmtAutoTable;
Cardinal vmtInitTable;
Cardinal vmtTypeInfo;
Cardinal vmtFieldTable;
Cardinal vmtMethodTable;
Cardinal vmtDynamicTable;
Cardinal vmtClassName;
Cardinal vmtInstanceSize;
Cardinal vmtParent;
Cardinal vmtSafeCallException;
Cardinal vmtAfterConstruction;
Cardinal vmtBeforeDestruction;
Cardinal vmtDispatch;
Cardinal vmtDefaultHandler;
Cardinal vmtNewInstance;
Cardinal vmtFreeInstance;
Cardinal vmtDestroy;
};
Where cardinal is unsigned int. The problem is that after using "Right Click > Struct offset" on top of the number 44 it generates the following result:
Result = *(Self - offsetof(VMT_ClassDefinition, vmtSafeCallException));
I was doing what is said in New features in Hex-Rays Decompiler 1.6 section 3, but as you can see the expected result and what I got is totally different.
My guess is that it forgets about the "-" sign and just advances from the start +44. Is there a way to reverse this behavior? I know it can be done in ASM view by inverting with "_" and then pressing "T" like in Negated structure offsets, but that does not apply to the Pseudocode view.