0

In IDA, I have the following disassembly code (from an old 16-bit DOS application) :

les     bx, _Foo
mov     word ptr es:[bx+84h], 0FFFFh
mov     word ptr es:[bx+8Ch], 0FFFFh
mov     word ptr es:[bx+8Ah], 0FFFFh

...

_Foo          dd 0    

_Foo is defined as double word (4 bytes) but it's actually a pointer to a structure. That structure is already defined in IDA. I would like IDA to know about it in order to replace all offsets by the actual field names :

les     bx, _Foo
mov     word ptr es:[bx+myStruct.FieldX], 0FFFFh
mov     word ptr es:[bx+myStruct.FieldY], 0FFFFh
mov     word ptr es:[bx+myStruct.FieldZ], 0FFFFh

This is something that can be done by selecting some code, pressing T, and then selecting appropriate structure, as explained here. However (AFAIK) this as to be done manually for each piece of code. I would like IDA to do that replacement automatically because it is aware of _Foo type.

After some search, I found how to set _Foo as pointer to struct: click on the variable, hit U (to undefine any type), then Y and enter myStruct* _Foo; in the dialog.

_Foo will now looks like this :

; myStruct *Foo
_Foo          dd 0   

It seems the only thing it does is to set variable back to dd and put type as comment. Field offsets are still not shown properly. It this a limitation of IDA ? (I use 7.5 version)

2 Answers 2

1

The Hex-Rays decompiler will automatically respond to changes in local or global variable types, and automatically display the memory dereferences as proper structure references. The same is not true for the disassembly listing in IDA, where you must manually create structure references. This is because the disassembly listing does not incorporate the type of sophisticated data flow analysis that Hex-Rays does: type of the global variable is causally unconnected to the subsequent uses of that variable after loading it into bx.

2
  • Unfortunately, AFAIK Hex-Rays decompiler cannot process 16-bit code.
    – tigrou
    Apr 29 at 11:29
  • Yes, that is correct. In short, IDA will not automatically do what you're asking, although HJex-Rays would (if it supported the platform). Apr 29 at 15:02
0

If you select all instructions referring to the structure and press T, you'll get a different dialog where you can select the base register and the struct to apply to offsets from it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.