5

I read that question here (How do you set registers as structs within a function in IDA?) but this applies only to individual lines.

Is it possible to set a register as a basepointer for a scope so that all usages of this register will be using the structure you assigned it to?

mov     eax, [ebx+C]
xor     [ebx+1C], eax
mov     eax, [ebx+24]
xor     [ebx+68], eax
mov     eax, [ebx+C]
xor     [ebx+30], eax
mov     eax, [ebx+24]
xor     [ebx+48], eax
...

Or do you have to apply T on each occurence individually?

Community
  • 1
Devolus
  • 963
  • 1
  • 10
  • 21
  • 1
    Select a range of instructions, use the same T shortcut as you would for a single usage. But be patient, the dialog window can take quite a while to appear, especially if you have a lot of structs defined or the selection is large. – DCoder Dec 08 '13 at 17:46
  • Thx! I didn't know that this can be applied to a selection. You should post it as an answer. – Devolus Dec 08 '13 at 18:54

1 Answers1

6

You need to select the range of instructions you're interested in, then use the same T shortcut as you would for a single occurrence. The dialog shown will allow you to select the register, the offset delta to add to the displacement, and the struct you want to apply.

The dialog does some preparation work/struct analysis before showing up. If you have a large selection or a lot of structures it can take a while to appear, you just need to be patient. When you change the register/delta inside the dialog, the analysis needs to be updated, which again takes time. Placing the selection cursor over an occurrence of the register you want to change before calling up the dialog is a good idea.

DCoder
  • 1,493
  • 12
  • 15