Am I missing symbols when RE'ing shellcode?

Question

I have a question about reversing a tutorial which shows how to reverse engineering shellcode. My question is simple:

In figure 4, we see at (7) TEX.ProcessEnvironmentBlock: is this a comment, or was IDA able to figure this out? When I reverse engineer the same payload, I see

edx, fs:[eax, 30h]

And at (8) I see:

edx, [edx, 0Ch]

is my IDA set up not correct? I heard about hard coded vtable values(?) which have an integer identifier. Not sure if I am mixing up things at the moment, but is that what we are looking at?

Answer 1

The user has applied a structure field reference to that operand. To do the same yourself, place your cursor over the memory operand (i.e., [eax+30h]) and press T to bring up the list of possible structures to apply.

Two more notes. IDA knows about many structures, but you might have to do a few things before you're able to select them from the T window as described above. If you don't see the structure you want in that window:

1. The first thing to try is to go to the structures window (Shift-F9 on Windows, or View -> Open subviews -> Structures) and press Insert to create a structure. Then select Add standard structure, and choose the one you want.

2. If the structure you want doesn't appear in the window popped up by Add standard structure, you might have to load a type library first. Go to View -> Open subviews -> Type libraries, then right-click and select Load type library... to see the list that IDA has available.