Hot answers tagged

22

You can't. In C, structs are there for the readers of the C program and their use in the program image is kinda optional. It's entirely possible that in the original program some crazy jerk decided to do everything with perfectly-sized char* buffers and cast and add appropriately, and you would never know the difference. The 'struct' labeling is entirely ...


21

There are very common patterns that you will find in code that denote structure usage. Dereferencing offsets: If you have a pointer which is dereferenced at some non-zero offset, you are probably dealing with a structure. Look for patterns like: mov eax, [ebp-8] ; Load a local variable into eax mov ecx, [eax+8] ; **Dereference a dword at eax+8** In ...


18

(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex) Few ways to find the other structures come to mind: Scanning memory for signatures Once you have a few examples of the structures, maybe the ...


14

Create a struct Apply the struct in one the four ways: use the T hotkey. Right-click the operand and choose the struct from "Structure offset" submenu. menu Edit|Operand types|Offset|Offset (struct) use the corresponding button on the Operand Type toolbar Here's a short tutorial: https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml


11

Finding structs is tricky, but can help in understanding the code a lot. As Andrew said, structs are just an C abstraction and in assembly, it is just a blob of memory and there is no fool proof way of identifying structs. However, for simpler programs, some heuristics can be helpful. For example, "small" sized arrays are more likely to be structs than giant ...


9

The easiest way of knowing when you are dealing with a structure, is when the code is calling functions for which you know (or documentation states) takes a structure as an argument. For example the in_addr structure of the inet_ntoa function. Given that IDA didn't figure this out in the first place.


9

Googling for 0x50435245 gives several hits, for example here: /* Magic number to provide a small check against being handed junk. Also used to detect whether a pattern was compiled on a host of different endianness. */ #define MAGIC_NUMBER 0x50435245UL /* 'PCRE' */ <...snip...> /* The real format of the start of the pcre block; the index of ...


8

There's several methods you can use (most of which have been hinted at by previous answers), but for completeness' sake I'll list some here. Look for calls to libraries that expect structures. Unless the executable is doing something it really shouldn't and casting pointers and then feeding them to the library function and hoping it doesn't crash (unlikely)...


8

I try to look for situations where a pointer to a chunk of data is passed into a function, then when it's used in that function, different offsets from it are treated as different data types. That indicates to me that 1) it's not an array of a single data type, and 2) it's being referenced from a base address rather than being passed as a separate parameter. ...


8

Add your struct in the function's stack view: With your cursor in the function's disassembly view, press Ctrl+K to open the stack view. In the stack view, ensure that enough function arguments exist to get to at least +00000010 in the stack. Use D to add more function arguments as necessary. Position your cursor on the +00000010 line in the stack view and ...


8

The ag command and subcommands can help you to output the visual graph into Graphviz format. [0x00000000]> ag? Usage: ag<graphtype><format> [addr] Graph commands: | aga[format] Data references graph .... | agf[format] Basic blocks function graph .... Output formats: | <blank> Ascii art | * ...


7

I published some tools on github which can do just that: https://github.com/nlitsme/pyidbutil and https://github.com/nlitsme/idbutil. The first is written in python, the second in C++, both have similar functionality. pyidbutil provides the most low level recovery options: using --pagedump you can dump each page in the file without the need of an intact ...


7

As Dcoder indicated, an array of short data types begins at the lower address, and the increment of the base of the array by 2 corresponds to adding 1 to the index. Consider the following C code: short array[256]; // ... cx = array[variable_1+1]; // ... // ... dx = array[variable_1]; // ... Consider the choices that the compiler has in compiling these ...


6

Igor is right on, here are a few additional tips I have to offer. Make sure when declaring variables within your structure, that you are accurately accommodating for the size of the variable. For example, is it a DWORD or some other multibyte buffer (maybe a memset/memcpy can give you a clue on its size here in these cases)? Accurately accounting for ...


6

Struct: Alt+Q Array: Numeric keypad *


6

To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it. Lets take the following code snippet taken from calc.exe ...


5

You should rather ask your questions with some kind of example output so that answers are not based on guesswork. Does iam loading the struct mean I wrote a program where I am employing OpenProcess() ReadProcessMemory() or does it mean i am opening the raw file with FILE * fp ; fopen("c:\XXX","wb") fread(fp); or load it in say ollydbg or in a ...


5

There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.


5

You need to select the range of instructions you're interested in, then use the same T shortcut as you would for a single occurrence. The dialog shown will allow you to select the register, the offset delta to add to the displacement, and the struct you want to apply. The dialog does some preparation work/struct analysis before showing up. If you have a ...


4

Yes. In StructB, select the field you want to convert to a sub-structure or create a new field by pressing D. With the given field selected, press Alt+Q and select StructA for the field.


4

From above... Decompiled: *(_DWORD *)(shipsStruct - 4) = playerPointer->ssXCoord; *(_DWORD *)shipsStruct = playerPointer->ssYCoord; ... Original: Ships[i].XCoordinate = *(DWORD *) (playerPtr + 0x4); Ships[i].YCoordinate = *(DWORD *) (playerPtr + 0x8); ... Based on these snippets, it looks like the structure in your stack variables is 8 bytes off. ...


4

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.


4

Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces. But I may suggest that you should foresee and be prepared to IDA database corruption, which is imminent and happens sooner or later to almost everyone. So: Prefer ...


4

Unless the string is at the end of the structure, it doesn't make sense to try and make this struct in IDA, because it probably doesn't even exist in C (or whatever the original language was). Now if the string is at the end of the struct, this might correlate to an actual C struct definition. This is called a "zero-length" array, or "flexible array member"....


4

First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use When a SIGTRAP is raised, normally the handler given in parameter of signal is called. If you have a debugger attached, this function will not get called. If your handler is never called, you can assume a ...


3

What you referring to as ptr-4 and ptr-8 are in fact location of singled out variables on stack. IDA has to know the structure in order to recognize it automatically. If you setup custom structure in "Structures" subview. Subsequently, You can manually set whatever variable you choose to be the type of that particular variable. Thereafter, IDA will replace ...


3

First Find the address you are looking for. Then cycle this: Find the base (the beginning of the record). Dissect the memory around this to recognize array or linked list. Search the memory for pointer to that base. Example: Scan for parameter finding the address 30000032. Find out the base of this record is 30000000. Checking memory - nothing fancy ...


3

Unfortunately this IDA feature doesn't always work as needed especially if you define your objects in Hex-Rays. If your problem is around using Hex-Rays, you can use the XRefs plugin with the hexrays-python API in IDA 6.4. As far as I understand latest version of IDAPython with support of IDA 6.5 at google code already contains these bindings in IDA API ...


3

IDA has been able to show cross-references to structure members since version 6.2:


3

This feature is supported since Hex-Rays 1.6: http://www.hexblog.com/?p=544 (see section 3. CONTAINING_RECORD macro)


Only top voted, non community-wiki answers of a minimum length are eligible