0

So I, against my best judgement, loaded an unpacked base after IDA crashed on me. And despite thinking to make a backup before doing that, I didn't do it.

So now I'm stuck with 4 broken structs. The IDA structs, not "Local Types" structs. I've still got the definitions for them in C-like syntax, however many of their fields are now corrupted with no name or type.

I've tried syncing the local type to the struct, it fails, saying that ObjectClass_vtbl.baseclass_0 failed to add member, offset=0 size=96 flags=60000400 errcode -1: already has member with this name or bad name (I'm using inheritance so basecall_0 is its first member). I've tried deleting the structs, undefining them, etc. and I wasn't able to make it fix itself. I kind of feel like the "lost names" are still lingering somewhere there, but I have no idea how to remove them.

The best I was able to do is create a new struct with a different name (e. g. add an underscore), and that works fine, and then just map the old one to the new one. But I don't really like the idea of being stuck with _ type names.

I also have a 2-week-old backup, and while copying the type info wouldn't be too much of an issue, I really don't want to copy over probably 500-1000 function names and definitions that I've fixued up since then.

Anyone knows how to get me out of this premise?

1
  • How deep do you want to go? Do you want to to fix the structures (possibly losing some attributes, but since they're damaged it might not matter), or do you want to just preserve the type information that you've applied and perhaps apply them to a different database? Fixing the member names can possibly be accomplished using the netnode API, but I'm not 100% on the other member attributes since only naming issues are being mentioned by the disassembler. Exporting the type information and your notes to a different database is likely the easier solution if you're not familiiar with idapython. Commented Mar 5 at 15:09

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.