You can't. In C, structs are there for the readers of the C program and their use in the program image is kinda optional. It's entirely possible that in the original program some crazy jerk decided to do everything with perfectly-sized char* buffers and cast and add appropriately, and you would never know the difference.
The 'struct' labeling is entirely ...
There are very common patterns that you will find in code that denote structure usage.
If you have a pointer which is dereferenced at some non-zero offset, you are probably dealing with a structure. Look for patterns like:
mov eax, [ebp-8] ; Load a local variable into eax
mov ecx, [eax+8] ; **Dereference a dword at eax+8**
(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex)
Few ways to find the other structures come to mind:
Scanning memory for signatures
Once you have a few examples of the structures, maybe the ...
Create a struct
Apply the struct in one the four ways:
use the T hotkey.
Right-click the operand and choose the struct from "Structure offset" submenu.
menu Edit|Operand types|Offset|Offset (struct)
use the corresponding button on the Operand Type toolbar
Here's a short tutorial: https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml
Finding structs is tricky, but can help in understanding the code a lot. As Andrew said, structs are just an C abstraction and in assembly, it is just a blob of memory and there is no fool proof way of identifying structs. However, for simpler programs, some heuristics can be helpful. For example, "small" sized arrays are more likely to be structs than giant ...
The easiest way of knowing when you are dealing with a structure, is when the code is calling functions for which you know (or documentation states) takes a structure as an argument.
For example the in_addr structure of the inet_ntoa function.
Given that IDA didn't figure this out in the first place.
Googling for 0x50435245 gives several hits, for example here:
/* Magic number to provide a small check against being handed junk. Also used
to detect whether a pattern was compiled on a host of different endianness. */
#define MAGIC_NUMBER 0x50435245UL /* 'PCRE' */
/* The real format of the start of the pcre block; the index of ...
The ag command and subcommands can help you to output the visual graph into Graphviz format.
Usage: ag<graphtype><format> [addr]
| aga[format] Data references graph
| agf[format] Basic blocks function graph
| <blank> Ascii art
| * ...
There's several methods you can use (most of which have been hinted at by previous answers), but for completeness' sake I'll list some here.
Look for calls to libraries that expect structures. Unless the executable is doing something it really shouldn't and casting pointers and then feeding them to the library function and hoping it doesn't crash (unlikely)...
I try to look for situations where a pointer to a chunk of data is passed into a function, then when it's used in that function, different offsets from it are treated as different data types. That indicates to me that 1) it's not an array of a single data type, and 2) it's being referenced from a base address rather than being passed as a separate parameter. ...
Add your struct in the function's stack view:
With your cursor in the function's disassembly view, press Ctrl+K to open the stack view.
In the stack view, ensure that enough function arguments exist to get to at least +00000010 in the stack. Use D to add more function arguments as necessary.
Position your cursor on the +00000010 line in the stack view and ...
To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it.
Lets take the following code snippet taken from calc.exe ...
As Dcoder indicated, an array of short data types begins at the lower address, and the increment of the base of the array by 2 corresponds to adding 1 to the index. Consider the following C code:
cx = array[variable_1+1];
dx = array[variable_1];
Consider the choices that the compiler has in compiling these ...
I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil.
The first is written in python, the second in C++, both have similar functionality.
pyidbutil provides the most low level recovery options: using --pagedump you can dump each page in the file without the need of an intact ...
Igor is right on, here are a few additional tips I have to offer.
Make sure when declaring variables within your structure, that you are accurately accommodating for the size of the variable. For example, is it a DWORD or some other multibyte buffer (maybe a memset/memcpy can give you a clue on its size here in these cases)?
Accurately accounting for ...
You should rather ask your questions with some kind of example output so that answers are not based on guesswork.
Does iam loading the struct mean
I wrote a program where I am employing OpenProcess() ReadProcessMemory()
or does it mean
i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a ...
You need to select the range of instructions you're interested in, then use the same T shortcut as you would for a single occurrence. The dialog shown will allow you to select the register, the offset delta to add to the displacement, and the struct you want to apply.
The dialog does some preparation work/struct analysis before showing up. If you have a ...
There are several things in your example that makes it hard to decompile.
s is the first, and only, local (so on the stack) variable in main(). main() is troublesome, as it's more or less a vararg-function if you read the C++ standard, and as you can see atleast IDA guesses that you have three arguments on the stack.
You use both int and long in your ...
In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.
*(_DWORD *)(shipsStruct - 4) = playerPointer->ssXCoord;
*(_DWORD *)shipsStruct = playerPointer->ssYCoord;
Ships[i].XCoordinate = *(DWORD *) (playerPtr + 0x4);
Ships[i].YCoordinate = *(DWORD *) (playerPtr + 0x8);
Based on these snippets, it looks like the structure in your stack variables is 8 bytes off. ...
Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces.
But I may suggest that you should foresee and be prepared to IDA database corruption, which is imminent and happens sooner or later to almost everyone. So:
Unless the string is at the end of the structure, it doesn't make sense to try and make this struct in IDA, because it probably doesn't even exist in C (or whatever the original language was).
Now if the string is at the end of the struct, this might correlate to an actual C struct definition. This is called a "zero-length" array, or "flexible array member"....
First, am I right to think that the purpose of this is to create a
handler for the SIGTRAP signal, probably in order to prevent any
When a SIGTRAP is raised, normally the handler given in parameter of signal is called. If you have a debugger attached, this function will not get called.
If your handler is never called, you can assume a ...
First Find the address you are looking for. Then cycle this:
Find the base (the beginning of the record).
Dissect the memory around this to recognize array or linked list.
Search the memory for pointer to that base.
Scan for parameter finding the address 30000032.
Find out the base of this record is 30000000.
Checking memory - nothing fancy ...
What you referring to as ptr-4 and ptr-8 are in fact location of singled out variables on stack. IDA has to know the structure in order to recognize it automatically. If you setup custom structure in "Structures" subview. Subsequently, You can manually set whatever variable you choose to be the type of that particular variable. Thereafter, IDA will replace ...
Unfortunately this IDA feature doesn't always work as needed especially if you define your objects in Hex-Rays.
If your problem is around using Hex-Rays, you can use the XRefs plugin with the hexrays-python API in IDA 6.4.
As far as I understand latest version of IDAPython with support of IDA 6.5 at
google code already contains these bindings in IDA API ...