How to apply IDA structure to a pointer of a structure

Question

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct in ebp
push    esi
push    edi
xor     ebx, ebx

and, not too far from above, I see it being populated:

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now I'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I'm using IDA Pro 6.3

Answer 1

To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it.

Lets take the following code snippet taken from calc.exe for example:

After selecting the relevant code and hitting T IDA automatically identified we're setting the ECX register, suggests possible valid structures to the left and the offsets and the selected structure's values.

After assigning a valid structure, the code looks like this:

Please notice the following caveats/remarks:

1. IDA completely ignored the add ecx, 4 line and additionally did not handle the mov [ecx+eax*2], dx too well because of that. Hitting T for that specific line and suppling a non-zero offset delta will let you handle that properly, albeit manually.
2. As mentioned in the comments, manually setting a register's name completely disables all IDA's representation of the register and instead displays the user supplied free text. This means any offset definitions will be hidden by any register custom name.
3. If you've seen [ebp+0f14h], the structure's size is at least 0xF15 bytes, as the structure is being written to at offset 0x0F14, meaning at least 0xF15 bytes are available to it. If you've seen DWORD [ebp+0f14h] the structure is at least 0x0F18 bytes long.

Those caveats are at least partially mitigated by third party tools like Autostruct