How to modify a structure field in IDA to reflect the correct union member in decompiled code?

Question

I'm reversing a Windows driver and using IDA to decompile some of its code. I've encountered an issue where the decompiler is using the wrong structure member in the decompiled output. Specifically, IDA shows this in the decompiled code:

NTSTATUS __fastcall DispatchFuncIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
{
  NTSTATUS IoStatus; // edi
  struct _IO_STACK_LOCATION *CurrentStackLocation; // rdx
  NTSTATUS v5; // eax
  ULONG_PTR IoInfo; // [rsp+38h] [rbp+10h] BYREF

  IoStatus = 0;
  CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation;
  IoInfo = 0LL;
  switch ( CurrentStackLocation->Parameters.Read.ByteOffset.LowPart )
  {
    case 0x222000u:
      v5 = sub_140001200(Irp, CurrentStackLocation, &IoInfo);
      goto LABEL_15;
    case 0x222008u:
      v5 = sub_1400010F4(Irp, CurrentStackLocation, &IoInfo);
      goto LABEL_15;
    // Additional cases...
  }
  Irp->IoStatus.Information = IoInfo;
  Irp->IoStatus.Status = IoStatus;
  IofCompleteRequest(Irp, IO_NO_INCREMENT);
  return IoStatus;
}

I believe that CurrentStackLocation->Parameters.Read.ByteOffset.LowPart is actually referring to CurrentStackLocation->Parameters.DeviceIoControl.IoControlCode, since they share the same memory offset in the _IO_STACK_LOCATION structure.

I want to fix this in IDA so that the decompiler uses DeviceIoControl.IoControlCode instead of Read.ByteOffset.LowPart. How can I make IDA to recognize this without modifying the struct definition?

Answer 1

I found that there is a 'select union field' command.