Questions tagged [struct]
A specific C language data-type construct which allow to declare a list of primitive types variables bound together in a single logical memory unit.
66
questions
0
votes
0
answers
32
views
How can I create a radare2 type for a variable-length struct?
I'm trying to parse a binary file and it has a structure similar to this,
struct foo {
int64_t count_things;
int64_t offset_to_thing[count];
int8_t bytes[];
int64_t other fields;
}
...
- 1,769
1
vote
0
answers
123
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
3
votes
1
answer
166
views
IDA Decompiler generates wrong output on array of structures!
There is a structure with size of 16-Bytes, and an array of it is defined.
The disassembly code for navigation through the array is:
MOV i, i,LSL#4
LDR R4, =arr_of_struct
ADD i, i, R4
LDR ...
- 171
2
votes
0
answers
64
views
Is it no longer possible to re-order structures in IDA?
In older versions of IDA, you could right-click a struct in the structure view and change its position in the list, making it easier to separate "internal" vs "external" structs. ...
- 121
2
votes
0
answers
39
views
PDF file have two trailers?
If I analyse multiple PDF files with a hex editor, I see that all of them have two trailers.
That's possible if an object has changed or renewed (https://blog.idrsolutions.com/multiple-trailers-in-a-...
- 21
2
votes
1
answer
234
views
Identify two structs in IDA
When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
- 143
1
vote
0
answers
47
views
Need help finding a windows struct
What I know about it:
struct unknown_struct
{
struct _KAPC apc;
struct _KEVENT event;
char unknown[2056];
};
So first a kernel apc struct then a kernel event struct and the total size is ...
0
votes
2
answers
837
views
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
In IDA, I have the following disassembly code (from an old 16-bit DOS application) :
les bx, _Foo
mov word ptr es:[bx+84h], 0FFFFh
mov word ptr es:[bx+8Ch], 0FFFFh
mov word ptr es:[bx+...
- 371
2
votes
1
answer
341
views
How do I reverse engineer structs that are put as parameters in a function
how do I go around figuring out where to reverse engineer a struct?
As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
2
votes
2
answers
449
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 573
-1
votes
2
answers
740
views
Parse offset to PE struct
Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example:
I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
- 67
1
vote
1
answer
150
views
Define partial struct with IDA
I want to define struct in Ida , but I know only partial of this struct
I only know that in arr[12] that int student_id , and I don't know the rest of struct. Ida recognize that struct as char * .
How ...
- 43
0
votes
1
answer
138
views
troublesome stack frame setup
I have a function with the first few instructions defined as follows:
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x70], rcx
mov ...
- 111
2
votes
1
answer
367
views
How to reverse engineer structs in radare2?
Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
- 45
1
vote
0
answers
48
views
How to replace a segment with a single structure consisting of the data in that segment - programmatically?
So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
- 455
2
votes
1
answer
135
views
What is the difference between uintX_n (used in IDA Pro) and unitX_t types?
During debugging a binary in IDA Pro, I've noticed types of the form
30 uint16_n 00000002 struct {uint16_t inner;}
42 uint32_n ...
- 277
2
votes
2
answers
372
views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
- 103
1
vote
1
answer
60
views
How are members of a Structure Type positioned on the stack?
Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
- 15
0
votes
1
answer
126
views
How is padding size calculated for members of structure types?
Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
- 15
0
votes
1
answer
67
views
Generate dummy struct in IDA hexrays
I remember that hexrays has the option to generate a dummy struct from a pointer. That is if we access a pointer in offsets 0x36, 0x24 it will create a struct with members off24 , off36.
In what ...
- 228
0
votes
1
answer
151
views
IDA: apply function parameter as struct pointer
In the following function foo
.text:0000000000401110 foo proc near
.text:0000000000401110
.text:0000000000401110 var_8 = qword ptr -8
.text:0000000000401110
.text:...
- 1,410
4
votes
2
answers
847
views
Struct reconstruction in decompilers
I'm testing several decompilers about struct reconstruction, given the following C example:
struct S {
int x;
int y;
long z;
long t;
};
int foo(struct S s) {
return s.x + s.y + s....
- 1,410
2
votes
1
answer
2k
views
What is __sighandler_t struct and purpose of SIGTRAP signal handler
I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :
.text:08048063 ...
- 281
1
vote
0
answers
136
views
Process Memory Viewing Tool
I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
- 111
2
votes
1
answer
814
views
How to properly label ALL structure members of C-style struct in IDA Pro
I've made a very trivial C program which throws a struct on the heap and then diassembled it. Surprisingly, IDA Pro actually identified the struct as soon as I added it by name using the Structures ...
- 1,830
2
votes
1
answer
3k
views
How can I define a struct in x64/x32Dbg?
See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
- 1,830
1
vote
1
answer
306
views
How can I unpack this archive file?
I recently discovered a binary container file in a GameCube video game which I cannot unpack!
I asked around, and I was told that it is an archive with this exact file structure:
char Signature[8];
...
- 11
8
votes
1
answer
3k
views
radare2 ascii graph to image?
After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image?
I have some huge main functions and it would be nice to have it ...
- 183
3
votes
2
answers
332
views
Problem with converting hex values to decimal
I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
- 33
1
vote
1
answer
2k
views
IDA Pro: how to pass a function a pointer to a structure field
When a C++ subclass object is being passed to a function which accepts base class objects, the C++ compiler implementation is so the subclass object pointer gets shifted down to point to the ...
- 11
2
votes
2
answers
588
views
Need help unraveling the format (time, string, float/decimal, integer/float/decimal) in .dat file
The files (idx, dat) are from a plant/facility operational historian. The .dat file is supposed to have entries, each with identifier (tag name/id/key), value (decimal/float) for different times (...
- 21
7
votes
2
answers
2k
views
Identifying possible structs in C/C++ disassembly
I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler
*(_DWORD *)(a2 + 16) = a2 + 624;
*(_DWORD *)(...
-2
votes
1
answer
70
views
Area calculations & what about 12.5m? [closed]
The shown girder is made from plain stone concrete and four 25 mm diameter steel wires.
Including the weight of steel wires, determine self weight of the girder if its length is 12.5 m.
Neglect the ...
-3
votes
1
answer
650
views
How to get Packet Structures
I'm trying to reverse engineer a game with the goal of creating an emulator.
I want to know how to get the structure of a network packet of a game whether it is client or server.
Example (Random) ...
- 1
0
votes
1
answer
4k
views
How can I export a struct in IDA Pro to a c-style struct?
I have a struct in IDA Pro that I want to export to a c-style struct. For example:
00000000 ICreateErrorInfo struc ; (sizeof=0x4, align=0x4, standard type)
00000000 ...
1
vote
1
answer
4k
views
IDA Array of structs hiding strings
I have just started teaching myself IDA and I have had some trouble with an array of structs.
I have found and defined a struct similar to this: (simplified)
struct {
char filename[50];
int field2;
...
- 113
6
votes
1
answer
10k
views
How to apply IDA structure to a pointer of a structure
I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.
arg_0= dword ptr 4 ;struct passed in
...
- 205
1
vote
1
answer
675
views
Where Ida Pro is using my defined structures
I'm have many functions that has a structure pointer as a function parameter (e.g. "VecInt *"). Ida knows that each function uses this type (because decompile window works fine). The same will happen ...
- 11
0
votes
1
answer
311
views
Counting offsets of structure fields [closed]
i have the following question:
For example, when I have the structure
IMAGE_SECTION_HEADER STRUCT | C1 | C2
Name1 BYTE | +0 | +0
...
- 1,531
1
vote
0
answers
97
views
Work out packet structure from usb capture
Im hoping to understand the way a auto diagnostics tool is reporting data over usb.
I've made a usb capture to look for changes according to known changes to the input it measures.
The measurement is ...
- 111
0
votes
1
answer
75
views
Target of offset into import directory unclear
During RCE of a piece of code, I have found this:
loc_40244F:
mov eax, [ebx+20h]
add ebx, 14h
test eax, eax
jnz loc_402397
What I know is that ebx points to the import directory ...
- 1,531
1
vote
1
answer
517
views
Using members of a struct in Win32 (MASM)
Due to the following topic,
Initializing a struct in win32 assembly programming using MASM
I tried to correct my mistakes, So I tried the following code :
.386
.model flat,stdcall
option casemap:...
- 67
2
votes
2
answers
3k
views
Initializing a struct in win32 assembly programming using MASM
I'm trying to create a demo program demonstrating struct(s) in MASM ,
I've written a code like this :
struct1 struct
first db ?
second dw ?
struct1 EndS
.386
.model flat,stdcall
option casemap:none
...
- 67
1
vote
2
answers
3k
views
Need Ideas to Reverse Engineer this HCC file format
January 17, 2015 update,
We made some progress by converting the CSV to hcc file; however, MT5 is deleting the file. Attached is our code. Can someone help us?
http://www.mediafire.com/download/...
- 11
2
votes
2
answers
262
views
Locate member of a structure
In an assembly line, I have a call to gethostbyname(...). I have read that the return value of that function can be a pointer to a hostent structure
(of course, it could be also a null pointer but for ...
- 1,531
1
vote
1
answer
108
views
Competitive Types
I have the following lines discovered in a piece of code (using IDA PRO) :
...
...
push 44h
pop edi
push edi ; size_t
xor esi, esi
lea eax, [ebp+StartupInfo]
push esi ; int
...
- 1,531
4
votes
2
answers
3k
views
Setting an IDA function pointer in a struct via script
The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
- 147
6
votes
2
answers
704
views
Reverse engineering Perl-compatible regular-expressions
I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
- 121
8
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
- 185
2
votes
1
answer
496
views
IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0
I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0.
I think ...
- 759