Hot answers tagged

19

(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex) Few ways to find the other structures come to mind: Scanning memory for signatures Once you have a few examples of the structures, maybe the ...


14

Create a struct Apply the struct in one the four ways: use the T hotkey. Right-click the operand and choose the struct from "Structure offset" submenu. menu Edit|Operand types|Offset|Offset (struct) use the corresponding button on the Operand Type toolbar Here's a short tutorial: https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml


9

Googling for 0x50435245 gives several hits, for example here: /* Magic number to provide a small check against being handed junk. Also used to detect whether a pattern was compiled on a host of different endianness. */ #define MAGIC_NUMBER 0x50435245UL /* 'PCRE' */ <...snip...> /* The real format of the start of the pcre block; the index of ...


9

The ag command and subcommands can help you to output the visual graph into Graphviz format. [0x00000000]> ag? Usage: ag<graphtype><format> [addr] Graph commands: | aga[format] Data references graph .... | agf[format] Basic blocks function graph .... Output formats: | <blank> Ascii art | * ...


8

As Dcoder indicated, an array of short data types begins at the lower address, and the increment of the base of the array by 2 corresponds to adding 1 to the index. Consider the following C code: short array[256]; // ... cx = array[variable_1+1]; // ... // ... dx = array[variable_1]; // ... Consider the choices that the compiler has in compiling these ...


8

Add your struct in the function's stack view: With your cursor in the function's disassembly view, press Ctrl+K to open the stack view. In the stack view, ensure that enough function arguments exist to get to at least +00000010 in the stack. Use D to add more function arguments as necessary. Position your cursor on the +00000010 line in the stack view and ...


8

To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it. Lets take the following code snippet taken from calc.exe ...


7

Struct: Alt+Q Array: Numeric keypad *


7

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have similar functionality. pyidbutil provides the most low level recovery options: using --pagedump you can dump each page in the file without the need of an intact ...


6

There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.


6

Igor is right on, here are a few additional tips I have to offer. Make sure when declaring variables within your structure, that you are accurately accommodating for the size of the variable. For example, is it a DWORD or some other multibyte buffer (maybe a memset/memcpy can give you a clue on its size here in these cases)? Accurately accounting for ...


5

You should rather ask your questions with some kind of example output so that answers are not based on guesswork. Does iam loading the struct mean I wrote a program where I am employing OpenProcess() ReadProcessMemory() or does it mean i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a ...


5

You need to select the range of instructions you're interested in, then use the same T shortcut as you would for a single occurrence. The dialog shown will allow you to select the register, the offset delta to add to the displacement, and the struct you want to apply. The dialog does some preparation work/struct analysis before showing up. If you have a ...


5

This feature is supported since Hex-Rays 1.6: http://www.hexblog.com/?p=544 (see section 3. CONTAINING_RECORD macro)


5

Yes. In StructB, select the field you want to convert to a sub-structure or create a new field by pressing D. With the given field selected, press Alt+Q and select StructA for the field.


5

There are several things in your example that makes it hard to decompile. s is the first, and only, local (so on the stack) variable in main(). main() is troublesome, as it's more or less a vararg-function if you read the C++ standard, and as you can see atleast IDA guesses that you have three arguments on the stack. You use both int and long in your ...


4

Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces. But I may suggest that you should foresee and be prepared to IDA database corruption, which is imminent and happens sooner or later to almost everyone. So: Prefer ...


4

From above... Decompiled: *(_DWORD *)(shipsStruct - 4) = playerPointer->ssXCoord; *(_DWORD *)shipsStruct = playerPointer->ssYCoord; ... Original: Ships[i].XCoordinate = *(DWORD *) (playerPtr + 0x4); Ships[i].YCoordinate = *(DWORD *) (playerPtr + 0x8); ... Based on these snippets, it looks like the structure in your stack variables is 8 bytes off. ...


4

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.


4

Unless the string is at the end of the structure, it doesn't make sense to try and make this struct in IDA, because it probably doesn't even exist in C (or whatever the original language was). Now if the string is at the end of the struct, this might correlate to an actual C struct definition. This is called a "zero-length" array, or "flexible array member"....


4

First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use When a SIGTRAP is raised, normally the handler given in parameter of signal is called. If you have a debugger attached, this function will not get called. If your handler is never called, you can assume a ...


3

What you referring to as ptr-4 and ptr-8 are in fact location of singled out variables on stack. IDA has to know the structure in order to recognize it automatically. If you setup custom structure in "Structures" subview. Subsequently, You can manually set whatever variable you choose to be the type of that particular variable. Thereafter, IDA will replace ...


3

First Find the address you are looking for. Then cycle this: Find the base (the beginning of the record). Dissect the memory around this to recognize array or linked list. Search the memory for pointer to that base. Example: Scan for parameter finding the address 30000032. Find out the base of this record is 30000000. Checking memory - nothing fancy ...


3

Unfortunately this IDA feature doesn't always work as needed especially if you define your objects in Hex-Rays. If your problem is around using Hex-Rays, you can use the XRefs plugin with the hexrays-python API in IDA 6.4. As far as I understand latest version of IDAPython with support of IDA 6.5 at google code already contains these bindings in IDA API ...


3

IDA has been able to show cross-references to structure members since version 6.2:


3

It seems to me that the problem is a bit worse than you describe, and there's no easy way to get around it. First, @sealed seems to be right with the function being a class method, and your compiler passing the class pointer in ecx, because that's the only way for .text:008F28B5 lea ecx, [esi+eax*4+4] .text:008F28B9 call ...


3

As I Don't know the prototype of ReadCfgEntry and structure of the code my answer is not exact. First: If the buffer is dynamically allocated As your function use ECX as initialized register: .text:008F2886 mov esi, ecx It is a class function so the owner class has a constructor that initiated the target buffer. you must trace the ...


3

The Y key equivalent is indeed the SetType (or, rather, ApplyType) function, and it normally accepts addresses. However, you actually can pass the structure member ID as the "address" to set the member's type info.


3

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the definition of Visual Studio variant of __thiscall calling convention. So I think that it is just large structure or object. In addition - structures in IDA not ...


3

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional field denoting the type of the object. Anyways, This looks like the Most significant bit of the first byte is not part of the length and has the special ...


Only top voted, non community-wiki answers of a minimum length are eligible