Questions tagged [struct]

A specific C language data-type construct which allow to declare a list of primitive types variables bound together in a single logical memory unit.

Filter by
Sorted by
Tagged with
-1
votes
0answers
51 views

Figuring out the structure of a file through disassembled code

I'm very new to reverse engineering and I've been trying to reverse engineer the structure of a file that defines a game's interface. I have managed to find an unpacked version of the DLL that ...
1
vote
1answer
48 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
0
votes
1answer
33 views

How is padding size calculated for members of structure types?

Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
0
votes
0answers
15 views

How is the data analyzed without knowing the object structure?

I found the address of the Entity list, but I don't know the object structure. I don't know what kind of data (char, pointer, int,double etc) on the member of list. Since the data sizes are different, ...
0
votes
1answer
26 views

Generate dummy struct in IDA hexrays

I remember that hexrays has the option to generate a dummy struct from a pointer. That is if we access a pointer in offsets 0x36, 0x24 it will create a struct with members off24 , off36. In what ...
0
votes
1answer
35 views

IDA: apply function parameter as struct pointer

In the following function foo .text:0000000000401110 foo proc near .text:0000000000401110 .text:0000000000401110 var_8 = qword ptr -8 .text:0000000000401110 .text:...
4
votes
2answers
312 views

Struct reconstruction in decompilers

I'm testing several decompilers about struct reconstruction, given the following C example: struct S { int x; int y; long z; long t; }; int foo(struct S s) { return s.x + s.y + s....
8
votes
1answer
3k views

radare2 ascii graph to image?

After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image? I have some huge main functions and it would be nice to have it ...
2
votes
1answer
489 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
12
votes
2answers
14k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
2
votes
1answer
443 views

How to properly label ALL structure members of C-style struct in IDA Pro

I've made a very trivial C program which throws a struct on the heap and then diassembled it. Surprisingly, IDA Pro actually identified the struct as soon as I added it by name using the Structures ...
-3
votes
1answer
435 views

How to get Packet Structures

I'm trying to reverse engineer a game with the goal of creating an emulator. I want to know how to get the structure of a network packet of a game whether it is client or server. Example (Random) ...
1
vote
0answers
112 views

Process Memory Viewing Tool

I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types ...
1
vote
1answer
2k views

How can I define a struct in x64/x32Dbg?

See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
1
vote
1answer
184 views

How can I unpack this archive file?

I recently discovered a binary container file in a GameCube video game which I cannot unpack! I asked around, and I was told that it is an archive with this exact file structure: char Signature[8]; ...
16
votes
3answers
6k views

Parsing/Rescuing corrupted IDA database

I'm reversing an application with IDA. My VM crashed and left the IDA database in a corrupted unpacked state. The next time I tried to load it back, IDA gave me the following error message: The ...
2
votes
2answers
2k views

Initializing a struct in win32 assembly programming using MASM

I'm trying to create a demo program demonstrating struct(s) in MASM , I've written a code like this : struct1 struct first db ? second dw ? struct1 EndS .386 .model flat,stdcall option casemap:none ...
0
votes
1answer
1k views

IDA Pro: how to pass a function a pointer to a structure field

When a C++ subclass object is being passed to a function which accepts base class objects, the C++ compiler implementation is so the subclass object pointer gets shifted down to point to the ...
3
votes
2answers
267 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
2
votes
2answers
470 views

Need help unraveling the format (time, string, float/decimal, integer/float/decimal) in .dat file

The files (idx, dat) are from a plant/facility operational historian. The .dat file is supposed to have entries, each with identifier (tag name/id/key), value (decimal/float) for different times (...
3
votes
1answer
1k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
-2
votes
1answer
64 views

Area calculations & what about 12.5m? [closed]

The shown girder is made from plain stone concrete and four 25 mm diameter steel wires. Including the weight of steel wires, determine self weight of the girder if its length is 12.5 m. Neglect the ...
1
vote
2answers
2k views

Need Ideas to Reverse Engineer this HCC file format

January 17, 2015 update, We made some progress by converting the CSV to hcc file; however, MT5 is deleting the file. Attached is our code. Can someone help us? http://www.mediafire.com/download/...
6
votes
1answer
7k views

How to apply IDA structure to a pointer of a structure

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it. arg_0= dword ptr 4 ;struct passed in ...
0
votes
1answer
2k views

How can I export a struct in IDA Pro to a c-style struct?

I have a struct in IDA Pro that I want to export to a c-style struct. For example: 00000000 ICreateErrorInfo struc ; (sizeof=0x4, align=0x4, standard type) 00000000 ...
22
votes
7answers
6k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
1
vote
1answer
380 views

Using members of a struct in Win32 (MASM)

Due to the following topic, Initializing a struct in win32 assembly programming using MASM I tried to correct my mistakes, So I tried the following code : .386 .model flat,stdcall option casemap:...
1
vote
1answer
3k views

IDA Array of structs hiding strings

I have just started teaching myself IDA and I have had some trouble with an array of structs. I have found and defined a struct similar to this: (simplified) struct { char filename[50]; int field2; ...
1
vote
1answer
473 views

Where Ida Pro is using my defined structures

I'm have many functions that has a structure pointer as a function parameter (e.g. "VecInt *"). Ida knows that each function uses this type (because decompile window works fine). The same will happen ...
0
votes
1answer
137 views

Counting offsets of structure fields [closed]

i have the following question: For example, when I have the structure IMAGE_SECTION_HEADER STRUCT | C1 | C2 Name1 BYTE | +0 | +0 ...
1
vote
0answers
74 views

Work out packet structure from usb capture

Im hoping to understand the way a auto diagnostics tool is reporting data over usb. I've made a usb capture to look for changes according to known changes to the input it measures. The measurement is ...
0
votes
1answer
68 views

Target of offset into import directory unclear

During RCE of a piece of code, I have found this: loc_40244F: mov eax, [ebx+20h] add ebx, 14h test eax, eax jnz loc_402397 What I know is that ebx points to the import directory ...
2
votes
2answers
211 views

Locate member of a structure

In an assembly line, I have a call to gethostbyname(...). I have read that the return value of that function can be a pointer to a hostent structure (of course, it could be also a null pointer but for ...
1
vote
1answer
83 views

Competitive Types

I have the following lines discovered in a piece of code (using IDA PRO) : ... ... push 44h pop edi push edi ; size_t xor esi, esi lea eax, [ebp+StartupInfo] push esi ; int ...
4
votes
2answers
2k views

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
6
votes
2answers
636 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
2
votes
1answer
327 views

IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0

I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0. I think ...
2
votes
1answer
1k views

IDA PRO Basics For Hex Rays How to fix address to struct which is dynamically calculated in if statement

I barely know any assembly and just started using IDA PRO a few months ago. I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this ...
2
votes
1answer
5k views

When defining a structure in IDA, can I define a field that is of another struct type?

I'm looking to define a structure in IDA like: struct StructA { int a; int b; } StructA; struct StructB { StructA a; int b; } StructB; Can I do this in IDA's structure definition ...
1
vote
2answers
648 views

Cross-referencing object fields

I'ld like to see which functions are operating with certain object's fields that I already processed, meaning I created the structure and assigned it to the correct places in the functions in IDA, ...
5
votes
2answers
4k views

IDA PRO Structures Defining negative offset -4 -8 offset repair asm Hex-Rays

How do I fix structures in IDA PRO so they show up properly in Hex-Rays plugin (C decompiler). Similar question to: (But the solution doesn't work for me) Struct with negative offset in IDA possible ...
5
votes
1answer
905 views

IDA: setting a register as a basepointer to struct

I read that question here (How do you set registers as structs within a function in IDA?) but this applies only to individual lines. Is it possible to set a register as a basepointer for a scope so ...
9
votes
2answers
10k views

Converting a virtual table from .rdata into an IDA struct

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry: And what the resulting struct should look like (but with all entries - this vtable specifically, ...
3
votes
1answer
5k views

In IDA how can I define a data address as a struct and array of datatype

As the title says im a bit lost on how to get something in the data section to be recognized as a struct or an array of structs or an array of strings etc. Cheers
8
votes
1answer
3k views

IDA Pro: use structs on parameters

I have a small function that is given a struct as parameters. The struct looks to something like this: struct my_struct { short a; unsigned int b; unsigned int c; }; Taking care of the ...