Questions tagged [struct]
A specific C language data-type construct which allow to declare a list of primitive types variables bound together in a single logical memory unit.
66
questions
24
votes
7
answers
7k
views
How is a structure located within a disassembled program?
I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
- 343
17
votes
3
answers
8k
views
Parsing/Rescuing corrupted IDA database
I'm reversing an application with IDA.
My VM crashed and left the IDA database in a corrupted unpacked state.
The next time I tried to load it back, IDA gave me the following error message: The ...
- 2,038
14
votes
2
answers
2k
views
How do you set registers as structs within a function in IDA?
For example, in the following disassembly:
.text:007C6834 014 mov eax, [esi+4]
.text:007C6837 014 mov dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::...
- 1,228
12
votes
2
answers
16k
views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
- 223
10
votes
3
answers
13k
views
Converting a virtual table from .rdata into an IDA struct
Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry:
And what the resulting struct should look like (but with all entries - this vtable specifically, ...
- 101
9
votes
1
answer
4k
views
IDA Pro: use structs on parameters
I have a small function that is given a struct as parameters. The struct looks to something like this:
struct my_struct {
short a;
unsigned int b;
unsigned int c;
};
Taking care of the ...
- 330
8
votes
1
answer
3k
views
radare2 ascii graph to image?
After analysing a function and pressing VV to go into graph mode, is it somehow possible to export/render the whole graph to an image?
I have some huge main functions and it would be nice to have it ...
- 183
8
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
- 185
7
votes
2
answers
2k
views
Identifying possible structs in C/C++ disassembly
I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler
*(_DWORD *)(a2 + 16) = a2 + 624;
*(_DWORD *)(...
7
votes
1
answer
3k
views
Struct with negative offset in IDA possible
I have a structure which looks like this:
RefString struct
RefCount dd ?
StrLen dd ?
CString db...
RefString ends
When the code passes around a pointer, it doesn't point to the ...
- 963
7
votes
1
answer
1k
views
Read a struct from memory
I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows).
What format do structs take in memory, and what ...
- 173
6
votes
2
answers
704
views
Reverse engineering Perl-compatible regular-expressions
I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
- 121
6
votes
1
answer
10k
views
How to apply IDA structure to a pointer of a structure
I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.
arg_0= dword ptr 4 ;struct passed in
...
- 205
6
votes
2
answers
3k
views
Creating a struct in IDA which contains a cString?
Normally I struct is a fixed size. Is it possible to define a structure which contains an element which has different sizes?
To illustrate what I mean is this.
The layout of the data in the file ...
- 963
5
votes
2
answers
5k
views
IDA PRO Structures Defining negative offset -4 -8 offset repair asm Hex-Rays
How do I fix structures in IDA PRO so they show up properly in Hex-Rays plugin (C decompiler).
Similar question to: (But the solution doesn't work for me) Struct with negative offset in IDA possible
...
- 759
5
votes
1
answer
1k
views
IDA: setting a register as a basepointer to struct
I read that question here (How do you set registers as structs within a function in IDA?) but this applies only to individual lines.
Is it possible to set a register as a basepointer for a scope so ...
- 963
4
votes
2
answers
849
views
Struct reconstruction in decompilers
I'm testing several decompilers about struct reconstruction, given the following C example:
struct S {
int x;
int y;
long z;
long t;
};
int foo(struct S s) {
return s.x + s.y + s....
- 1,410
4
votes
1
answer
7k
views
In IDA how can I define a data address as a struct and array of datatype
As the title says im a bit lost on how to get something in the data section to be recognized as a struct or an array of structs or an array of strings etc.
Cheers
- 188
4
votes
2
answers
3k
views
Setting an IDA function pointer in a struct via script
The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
- 147
3
votes
1
answer
374
views
What type of data structure is it?
I have the following data:
.data:004305FC word_4305FC dw 1583h
.data:004305FC
.data:004305FE word_4305FE dw 35B6h
....
- 3,088
3
votes
2
answers
334
views
Problem with converting hex values to decimal
I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
- 33
3
votes
1
answer
6k
views
When defining a structure in IDA, can I define a field that is of another struct type?
I'm looking to define a structure in IDA like:
struct StructA {
int a;
int b;
} StructA;
struct StructB {
StructA a;
int b;
} StructB;
Can I do this in IDA's structure definition ...
- 233
3
votes
1
answer
2k
views
IDA PRO Basics For Hex Rays How to fix address to struct which is dynamically calculated in if statement
I barely know any assembly and just started using IDA PRO a few months ago.
I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this ...
- 759
3
votes
1
answer
168
views
IDA Decompiler generates wrong output on array of structures!
There is a structure with size of 16-Bytes, and an array of it is defined.
The disassembly code for navigation through the array is:
MOV i, i,LSL#4
LDR R4, =arr_of_struct
ADD i, i, R4
LDR ...
- 171
2
votes
1
answer
236
views
Identify two structs in IDA
When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
- 143
2
votes
2
answers
458
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 573
2
votes
1
answer
2k
views
What is __sighandler_t struct and purpose of SIGTRAP signal handler
I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :
.text:08048063 ...
- 281
2
votes
1
answer
367
views
How to reverse engineer structs in radare2?
Is there any way to indentify structs in radare2?
when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
- 45
2
votes
1
answer
135
views
What is the difference between uintX_n (used in IDA Pro) and unitX_t types?
During debugging a binary in IDA Pro, I've noticed types of the form
30 uint16_n 00000002 struct {uint16_t inner;}
42 uint32_n ...
- 277
2
votes
2
answers
374
views
C++ structure containing a RTTI getter function?
I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*, I've read some articles on RTTI and reversing C++ but can't ...
- 103
2
votes
1
answer
3k
views
How can I define a struct in x64/x32Dbg?
See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
- 1,830
2
votes
2
answers
262
views
Locate member of a structure
In an assembly line, I have a call to gethostbyname(...). I have read that the return value of that function can be a pointer to a hostent structure
(of course, it could be also a null pointer but for ...
- 1,531
2
votes
1
answer
344
views
How do I reverse engineer structs that are put as parameters in a function
how do I go around figuring out where to reverse engineer a struct?
As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
2
votes
1
answer
817
views
How to properly label ALL structure members of C-style struct in IDA Pro
I've made a very trivial C program which throws a struct on the heap and then diassembled it. Surprisingly, IDA Pro actually identified the struct as soon as I added it by name using the Structures ...
- 1,830
2
votes
2
answers
588
views
Need help unraveling the format (time, string, float/decimal, integer/float/decimal) in .dat file
The files (idx, dat) are from a plant/facility operational historian. The .dat file is supposed to have entries, each with identifier (tag name/id/key), value (decimal/float) for different times (...
- 21
2
votes
2
answers
3k
views
Initializing a struct in win32 assembly programming using MASM
I'm trying to create a demo program demonstrating struct(s) in MASM ,
I've written a code like this :
struct1 struct
first db ?
second dw ?
struct1 EndS
.386
.model flat,stdcall
option casemap:none
...
- 67
2
votes
1
answer
498
views
IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0
I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0.
I think ...
- 759
2
votes
0
answers
65
views
Is it no longer possible to re-order structures in IDA?
In older versions of IDA, you could right-click a struct in the structure view and change its position in the list, making it easier to separate "internal" vs "external" structs. ...
- 121
2
votes
0
answers
40
views
PDF file have two trailers?
If I analyse multiple PDF files with a hex editor, I see that all of them have two trailers.
That's possible if an object has changed or renewed (https://blog.idrsolutions.com/multiple-trailers-in-a-...
- 21
1
vote
2
answers
763
views
Cross-referencing object fields
I'ld like to see which functions are operating with certain object's fields that I already processed, meaning I created the structure and assigned it to the correct places in the functions in IDA, ...
- 2,038
1
vote
2
answers
3k
views
Need Ideas to Reverse Engineer this HCC file format
January 17, 2015 update,
We made some progress by converting the CSV to hcc file; however, MT5 is deleting the file. Attached is our code. Can someone help us?
http://www.mediafire.com/download/...
- 11
1
vote
1
answer
60
views
How are members of a Structure Type positioned on the stack?
Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
- 15
1
vote
1
answer
108
views
Competitive Types
I have the following lines discovered in a piece of code (using IDA PRO) :
...
...
push 44h
pop edi
push edi ; size_t
xor esi, esi
lea eax, [ebp+StartupInfo]
push esi ; int
...
- 1,531
1
vote
1
answer
2k
views
IDA Pro: how to pass a function a pointer to a structure field
When a C++ subclass object is being passed to a function which accepts base class objects, the C++ compiler implementation is so the subclass object pointer gets shifted down to point to the ...
- 11
1
vote
1
answer
150
views
Define partial struct with IDA
I want to define struct in Ida , but I know only partial of this struct
I only know that in arr[12] that int student_id , and I don't know the rest of struct. Ida recognize that struct as char * .
How ...
- 43
1
vote
1
answer
306
views
How can I unpack this archive file?
I recently discovered a binary container file in a GameCube video game which I cannot unpack!
I asked around, and I was told that it is an archive with this exact file structure:
char Signature[8];
...
- 11
1
vote
1
answer
676
views
Where Ida Pro is using my defined structures
I'm have many functions that has a structure pointer as a function parameter (e.g. "VecInt *"). Ida knows that each function uses this type (because decompile window works fine). The same will happen ...
- 11
1
vote
1
answer
520
views
Using members of a struct in Win32 (MASM)
Due to the following topic,
Initializing a struct in win32 assembly programming using MASM
I tried to correct my mistakes, So I tried the following code :
.386
.model flat,stdcall
option casemap:...
- 67
1
vote
0
answers
33
views
How can I create a radare2 type for a variable-length struct?
I'm trying to parse a binary file and it has a structure similar to this,
struct foo {
int64_t count_things;
int64_t offset_to_thing[count];
int8_t bytes[];
int64_t other fields;
}
...
- 1,779
1
vote
0
answers
133
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
