1

When I define data as a structure with IDAPython, it appears in IDA View in a collapsed view. Out of curiosity, is it possible to programmatically expand the view of the structure?

For example, if I run MakeStructEx(0x400000, -1, "IMAGE_DOS_HEADER"), I see:

IMAGE_DOS_HEADER <5A4Dh, 90h, 3, 0, 4, 0, 0FFFFh, 0, 0B8h, 0, 0, 0, \
                  40h, 0, 0, 0, 0, 0, 0E0h>

But I would like to see:

dw 5A4D                ; e_magic
dw 90h                 ; e_cblp
dw 3                   ; e_cp
dw 0                   ; e_crlc
... (lines removed) ...
dd 0E0h                ; e_lfanew

I am using IDA 6.2.

4

Put the text cursor somewhere between the < and > and press + on the numeric keypad.

  • 1
    Just for completeness : in IDA 6.8 it is Ctrl and + – w s Jan 27 '16 at 8:17
  • I know the keyboard shortcut, but I am looking for a programmatic solution. For example, something I can control with IDAPython – user1354557 Feb 2 '16 at 22:15
2

Unfortunately I don't have IDA 6.2, but if this version supports IDAPython and corresponding APIs you can try to do the following:

import idc
idc.Jump(address)
idc.ProcessUiAction("UnHide", 0)

This will move the cursor to the "address" ea and replay user action associated with "UnHide" string, which is Ctrl+Numpad+, which does what you requested in IDA 6.8. I think that it should work in IDA 6.2 too. There is a chance good chance that there is some IDAPython API designed specifically for that, but I was unable to find it.

This definitely works in IDA 6.8. Good luck

  • Unfortunately this doesn't work for me on IDA 6.2, but +1 in case someone with a different version is trying to solve the same problem – user1354557 Feb 2 '16 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.