10

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:

enter image description here

I was able to retype gpfnCommCtrlAPI into char*[14] which made it quite readable:

enter image description here

But then is it possible to retype g_pfnsUxCtrl, a pointer to an array of function pointers, (possibly with a custom enum) to make it a little bit more readable? Here's an example of how it looks now in case of g_pfnsUxCtrl[7]:

enter image description here

PS. To understand what index 7 refers to in that case I need to go back to the gpfnCommCtrlAPI array, which may not be immediately available where g_pfnsUxCtrl[7] is used.

PS2. In that case case, I manually renamed p_comctl32_HandleScrollCmd variable to make it more readable.

c00000fd
  • 1,659
  • 3
  • 25
  • 41

1 Answers1

3

you are able to add your own enum type inside Data Type Manager. (Keep in mind to select correct size).

enter image description here

enter image description here

enter image description here

Then you should be able to change the type to your newly created enum and everything should be nicely resolved.

erexo
  • 263
  • 3
  • 8
  • yeah, that's how you define a generic enum. But how would you apply it to the particular example I showed above? – c00000fd Apr 23 '19 at 20:41
  • if that proc list is relatively short with const count and you really would like custom names instead of integers, then you can create a custom type with lots of integers of different names. Then you'll have a single object with couple of variables and each of those will have a custom name. And if those addresses are constant which is kinda stupid but you can look where you land with that, you can try to set p_comct132_HandleScrollCmd to enumType and g_pfnsUxCtrl to pointer to enumType. Both solutions are silly, in your case I'd just memorize those integers – erexo Apr 24 '19 at 13:26