I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.
arg_0= dword ptr 4 ;struct passed in push ebx push ebp mov ebp, [esp+8+arg_0] ; store pointer of struct in ebp push esi push edi xor ebx, ebx
and, not too far from above, I see it being populated:
mov [ebp+0D4h], bl mov [ebp+0F4h], bl mov [ebp+114h], bl xor eax, eax mov [ebp+0B8h], eax mov [ebp+0BCh], eax mov [ebp+0C0h], eax
I do not know the size of the structure, but I've seen
[ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size
0xF14. Now I'm having trouble with applying this custom structure to this pointer. I've tried
Alt+Q then selecting my own custom struct, but it is not working. The output window says
Command "DeclareStructVar" failed
My custom struct:
00000000 custom_sturct struc ; (sizeof=0xF14) 00000000 db ? ; undefined 00000001 db ? ; undefined 00000002 db ? ; undefined [...same stuff...] 00000F11 db ? ; undefined 00000F12 db ? ; undefined 00000F13 field_F13 db ? 00000F14 custom_sturct ends 00000F14
I'm using IDA Pro 6.3
ebpuse the structure automatically. You'll have to right-click each of the offsets, select "Structure offset" from the context menu, then select your
custom_structfield. (Or, as a shortcut, use the
ebpregister a custom name. The
custom_structshowed up after I've removed the custom name for the register.
t. A different menu will appear which will allow you to select a register (choose
ebp) and a structure (choose
custom_struct) and it will convert each offset from
ebpwithin the selection to an offset of
custom_struct. This works best in the linear view.