1

Sometimes when I am figuring out a struct in IDA, there will be a really big offset and IDA will decide the struct is an array.

Consider this from ALPC:

  if ( (_Message[1].u1.Length & 0x200) != 0 && (PortObject->MainQueueLength & 0x2000) != 0 )
    {
      v46 = _InterlockedCompareExchange64((volatile signed __int64 *)&PortObject[1], (signed __int64)_Message, 0i64);
      _Message = (_PORT_MESSAGE64 *)Message;

I appear to have the struct offsets wrong for port object. It thinks that portobject is an array because it sees an offset off the end of the struct I defined. PortObject is definitely an object best interpreted as a struct - zero chance it's an array.

How can I make hexrays show the offset in the format of PortObject+0xsomeoffset rather than defaulting to the annoying array notation? It makes it much easier to flip back and forth and figure out what's wrong if things aren't being displayed as an array.

Improve this question
1
  • Prolly not the answer you're looking for, but make sure the size of your type is correct. Usually if you know your type's scope, you can figure its size from the max offset when it gets initialized...it's probably better to train your eyes on spotting unnamed fields. What I've been tending to do lately in order to work around the array syntax (because I agree with your suggestion of making it easier for quick reads), is to declare types that are pointers as int instead of things like void* (which hides the cast). This seems to result in displaying the offset, but is likely a terrible idea.
    – Ali Rizvi-Santiago
    Aug 12 at 16:23

1 Answer 1

Reset to default
1

PortObject[1] means the referenced offset is just outside of your struct definition, so IDA indexes it with 1 as a second PortObject. Extend your structure definition with a pointer so IDA can resolve it properly.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.