I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.
arg_0= dword ptr 4 ;struct passed in
push ebx
push ebp
mov ebp, [esp+8+arg_0] ; store pointer of struct in ebp
push esi
push edi
xor ebx, ebx
and, not too far from above, I see it being populated:
mov [ebp+0D4h], bl
mov [ebp+0F4h], bl
mov [ebp+114h], bl
xor eax, eax
mov [ebp+0B8h], eax
mov [ebp+0BCh], eax
mov [ebp+0C0h], eax
I do not know the size of the structure, but I've seen [ebp+0f14h]
. Therefore, I've defined a custom IDA sturct of size 0xF14
. Now I'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q
then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed
My custom struct:
00000000 custom_sturct struc ; (sizeof=0xF14)
00000000 db ? ; undefined
00000001 db ? ; undefined
00000002 db ? ; undefined
[...same stuff...]
00000F11 db ? ; undefined
00000F12 db ? ; undefined
00000F13 field_F13 db ?
00000F14 custom_sturct ends
00000F14
I'm using IDA Pro 6.3