Is there any easy way to define a field in big struct by IDA?

Question

By tracing malloc or similar memory allocation functions, I got a huge struct.

Initially, since I didn't know the intent of the various fields of the struct, I defined it with a byte array.

struct NCSI_INTERFACE_ATTRIBUTES
{
  BYTE Gap[12880];
};

As the analysis progressed, I reverted some fields. By calculating the offset, I split the Gap in two and reduce some of the bytes to replace it with the field type I want.

struct NCSI_INTERFACE_ATTRIBUTES
{
  NET_LUID_LH InterfaceLuid;
  GUID InterfaceGuid;
  BYTE Gap[4512];
  NCSI_CAPABILITY_CHANGE_REASON CapabilityChangeReasonV4; // DWORD enum
  BYTE Gap1[3932];
  NCSI_CAPABILITY_CHANGE_REASON CapabilityChangeReasonV6; // DWORD enum
  BYTE Gap2[4404];
};

Now, I found two new field need to define. They're at the offset Gap[4508] and Gap[3936 + 4508] (You will see why I use + here for description at the follow).

For the first field at Gap[4508], it's easy, just reduce Gap size to 4508 then define a new DWORD field follow it, done.

For the second field, since it's an offset relative to the Gap, I'd have to manually calculate the size of all the fields after the Gap (possibly including alignment) and then insert at the correct location, either in Gap1 or Gap2. For insert I may need to split the Gap1/Gap2 again. This is error prone and time consuming.

So I'm here to ask if there is a way in IDA to do all this easily.

For example, I provide a field of struct, a offset relative to the field, the new field type/size, IDA split the Gap, insert the new field and keep the struct size not change (reduce the Gap by the new field type).

Answer 1

This specific case looks like that you have an array of other structures (or sequential similar structures, but according to using the + it is unlikely because it is standard pattern for accessing the array) inside the structure in question. It is possible (and very much likely because of the size of the gap between them) that capability change reasons are also members of these structures. The size of the inner structure should be 3936 (a value that is multiplied by family), and it starts somewhere inside the first Gap field. In this case I would create a separate type for the inner structure, and place the array of 2 such structures inside the main structure according to the use of inner fields inside (you can check assembly code that accesses both capability change reasons for that).