2

By tracing malloc or similar memory allocation functions, I got a huge struct.

Initially, since I didn't know the intent of the various fields of the struct, I defined it with a byte array.

struct NCSI_INTERFACE_ATTRIBUTES
{
  BYTE Gap[12880];
};

As the analysis progressed, I reverted some fields. By calculating the offset, I split the Gap in two and reduce some of the bytes to replace it with the field type I want.

struct NCSI_INTERFACE_ATTRIBUTES
{
  NET_LUID_LH InterfaceLuid;
  GUID InterfaceGuid;
  BYTE Gap[4512];
  NCSI_CAPABILITY_CHANGE_REASON CapabilityChangeReasonV4; // DWORD enum
  BYTE Gap1[3932];
  NCSI_CAPABILITY_CHANGE_REASON CapabilityChangeReasonV6; // DWORD enum
  BYTE Gap2[4404];
};

Now, I found two new field need to define. They're at the offset Gap[4508] and Gap[3936 + 4508] (You will see why I use + here for description at the follow).

For the first field at Gap[4508], it's easy, just reduce Gap size to 4508 then define a new DWORD field follow it, done.

For the second field, since it's an offset relative to the Gap, I'd have to manually calculate the size of all the fields after the Gap (possibly including alignment) and then insert at the correct location, either in Gap1 or Gap2. For insert I may need to split the Gap1/Gap2 again. This is error prone and time consuming.

So I'm here to ask if there is a way in IDA to do all this easily.

For example, I provide a field of struct, a offset relative to the field, the new field type/size, IDA split the Gap, insert the new field and keep the struct size not change (reduce the Gap by the new field type).

enter image description here

2
  • 1
    One way you can go about this is instead of declaring the byte array in-line, simply declare a union in its place. One member of the union will be a byte array the maximum size of the struct you uncovered (as you had), the other member will be a newly defined struct with the evolving view of the structure as you learn more about it.
    – 0xC0000022L
    Commented Jan 18, 2023 at 10:15
  • @0xC0000022L For the newly defined struct in the union, how can I specific a field with a offset directly, instead of thinking about placing gaps before and after it?
    – huang
    Commented Jan 18, 2023 at 13:11

1 Answer 1

1

This specific case looks like that you have an array of other structures (or sequential similar structures, but according to using the + it is unlikely because it is standard pattern for accessing the array) inside the structure in question. It is possible (and very much likely because of the size of the gap between them) that capability change reasons are also members of these structures. The size of the inner structure should be 3936 (a value that is multiplied by family), and it starts somewhere inside the first Gap field. In this case I would create a separate type for the inner structure, and place the array of 2 such structures inside the main structure according to the use of inner fields inside (you can check assembly code that accesses both capability change reasons for that).

1
  • This is a viable solution, but it would be better if IDA provided a progressive field definition feature. As 0xC0000022L pointed out in the comments, union is an option, but this feature IDA can clearly do better, and this feature is what most people need (at least i think so).
    – huang
    Commented Jan 18, 2023 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.