Skip to main content
4 of 4
added 30 characters in body
NirIzr
  • 11.8k
  • 1
  • 38
  • 87

How to apply IDA structure to a pointer of a structure

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct in ebp
push    esi
push    edi
xor     ebx, ebx

and, not too far from above, I see it being populated:

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now I'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I'm using IDA Pro 6.3