3

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view.

Here's one instruction I'm looking at.

        00010042 33 7c 00        move.w     #0x2,(0x1c,A1)
                 02 00 1c

A1 points to a struct, and 2 is the value being written to a specific field of that struct.

Now I can use E to specify that a particular value is an equ, which is what I'll be doing with the #0x2 here.

But what about when a value is a struct offset, as is the case with the 0x1c?

I happen to know what sort of struct A1 points to, and I've set up this struct in the structure editor. And Ghidra clearly knows that 0x1c is a value that corresponds to the offset of a particular word-size member of at least one struct in its struct database.

enter image description here

So how do I tell it that the 0x1c offset in this particular instruction refers to some field in some struct? Ideally I'd expect it to be able work through its struct database, find all the fields in all the structs that have an offset of 0x1c, and let me select which particular field I think this offset is. Then render it appropriately, e.g., something like move.w #0x2,(IOStdReq.io_Message.io_Command,A1).

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.