4

Normally I struct is a fixed size. Is it possible to define a structure which contains an element which has different sizes?

To illustrate what I mean is this.

The layout of the data in the file looks like this:

ID          WORD 0
FunctionPtr DWORD OFFSET Fkt
Name        db 'Name of the function',0
align 4

'Name' is now a C-String which is as long until it reaches the 0-byte at the end and then follows the align instruction. So is it possible to tell IDA that the structure is including the string, no matter how long it is?

  • Are you sure that that's how it's actually implemented in the code? At least in c this would be the place where you either have a static array of some fixed size or a pointer to the beginning of the string which you have malloced space for. If that isn't the case the struct (once again thinking c, sorry) would have to have different names for all the different sizes or be some kind of union. – lfxgroove Nov 18 '13 at 19:27
  • Yes, I'm sure. There is a counter value at the head, which tells how many entries there are, and the follows an array of such structures. – Devolus Nov 19 '13 at 9:07
4

Unless the string is at the end of the structure, it doesn't make sense to try and make this struct in IDA, because it probably doesn't even exist in C (or whatever the original language was).

Now if the string is at the end of the struct, this might correlate to an actual C struct definition. This is called a "zero-length" array, or "flexible array member". Of course, the size of this array is zero, as far as sizeof is concerned.

Unfortunately, this still doesn't exist in IDA. What I've done in the past (again, where the string is last) is go ahead and create a one-byte field, so you at least know where the string starts. This will complicate things if you try to use size mystruct for any constants in the code, but at least your string offset will be correct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.