I have a structure which looks like this:
RefString struct
RefCount dd ?
StrLen dd ?
CString db...
RefString ends
When the code passes around a pointer, it doesn't point to the beginning of the struct (RefCount), instead it points to CString, which is allocated as a normal C-String with a zero terminating character, as well as having the strlen and a refcount. So when the code accesses the strlen or refcount it uses ptr-4
respectively ptr-8
.
Actually that's quite a nice construct, because this way the string can be used as a delphistring, but also directly passed to some system functions without the need of converting back and forth.
Now I wonder though, if it is possible in IDA to create a struct with the basepointer to the string and it knows that the other fields are with the negative offset.