7

I have a structure which looks like this:

 RefString struct
     RefCount dd ?
     StrLen   dd ?
     CString  db...
 RefString ends

When the code passes around a pointer, it doesn't point to the beginning of the struct (RefCount), instead it points to CString, which is allocated as a normal C-String with a zero terminating character, as well as having the strlen and a refcount. So when the code accesses the strlen or refcount it uses ptr-4 respectively ptr-8.

Actually that's quite a nice construct, because this way the string can be used as a delphistring, but also directly passed to some system functions without the need of converting back and forth.

Now I wonder though, if it is possible in IDA to create a struct with the basepointer to the string and it knows that the other fields are with the negative offset.

Improve this question
5
  • the main purposes of struct is to organize data in a logical container and pass it around. What would be the point of having to reference the struct from the end of it?
    – PSS
    Nov 4, 2013 at 20:10
  • There is no rule that prohibits negative offsets, it's just a common practice to use positive ones. ;) And as I showed, I have such code which uses this kind of addressing, which makes it a bit annyoing to track in IDA.
    – Devolus
    Nov 4, 2013 at 21:45
  • I see. I just I think of it in a different way. For me it was always a lot more straight forward to ref structs from the "head".
    – PSS
    Nov 5, 2013 at 4:58
  • Well, the code was not written by me. It makes sense, how it was done, but I also would prefer to have it straightforward. But the code did it like this, so when a pointer is passed around, it points "in the middle" of the struct and when IDA does automatica updates it screwes up stuff, because of this.
    – Devolus
    Nov 5, 2013 at 7:57
  • Kinda sounds like Delphi strings, where hints about the actual length (as in a counted string) and the allocated size are kept in front of the actual data. Except that in such a case the data directly follows the length/size fields.
    – 0xC0000022L ♦
    Apr 13, 2016 at 12:49

1 Answer 1

Reset to default
5

What you referring to as ptr-4 and ptr-8 are in fact location of singled out variables on stack. IDA has to know the structure in order to recognize it automatically. If you setup custom structure in "Structures" subview. Subsequently, You can manually set whatever variable you choose to be the type of that particular variable. Thereafter, IDA will replace references within disassembly view with appropriate offsets to the structure members.

If IDA "lands" in what seems to be the middle of the structure. You could follow the work around below to make it display it differently:

  1. invert the operand sign by pressing _ (underscore)
  2. select the instruction
  3. press T. provide calculated delta, select the desired structure and its field

For details consult Negative structure offsets of Hex Blog.

Improve this answer
1
  • This strcuture is not a stackpointer object, it is indeed how the strcuture is setup. Your solution works at least partway, because with this I can assign the member names, which helps. A drawback is still that a globabl structure pointer causes some problems, because it points not there, but as you said, it's a workaround.
    – Devolus
    Nov 6, 2013 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.