In IDA, I have the following disassembly code (from an old 16-bit DOS application) :
les bx, _Foo
mov word ptr es:[bx+84h], 0FFFFh
mov word ptr es:[bx+8Ch], 0FFFFh
mov word ptr es:[bx+8Ah], 0FFFFh
...
_Foo dd 0
_Foo
is defined as double word (4 bytes) but it's actually a pointer to a structure. That structure is already defined in IDA. I would like IDA to know about it in order to replace all offsets by the actual field names :
les bx, _Foo
mov word ptr es:[bx+myStruct.FieldX], 0FFFFh
mov word ptr es:[bx+myStruct.FieldY], 0FFFFh
mov word ptr es:[bx+myStruct.FieldZ], 0FFFFh
This is something that can be done by selecting some code, pressing T, and then selecting appropriate structure, as explained here. However (AFAIK) this as to be done manually for each piece of code. I would like IDA to do that replacement automatically because it is aware of _Foo
type.
After some search, I found how to set _Foo
as pointer to struct:
click on the variable, hit U (to undefine any type), then Y and enter myStruct* _Foo;
in the dialog.
_Foo
will now looks like this :
; myStruct *Foo
_Foo dd 0
It seems the only thing it does is to set variable back to dd
and put type as comment. Field offsets are still not shown properly. It this a limitation of IDA ? (I use 7.5 version)