6

I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.

arg_0= dword ptr  4   ;struct passed in

push    ebx
push    ebp
mov     ebp, [esp+8+arg_0]  ; store pointer of struct in ebp
push    esi
push    edi
xor     ebx, ebx

and, not too far from above, I see it being populated:

mov     [ebp+0D4h], bl
mov     [ebp+0F4h], bl
mov     [ebp+114h], bl
xor     eax, eax
mov     [ebp+0B8h], eax
mov     [ebp+0BCh], eax
mov     [ebp+0C0h], eax

I do not know the size of the structure, but I've seen [ebp+0f14h]. Therefore, I've defined a custom IDA sturct of size 0xF14. Now I'm having trouble with applying this custom structure to this pointer. I've tried Alt+Q then selecting my own custom struct, but it is not working. The output window says Command "DeclareStructVar" failed

My custom struct:

00000000 custom_sturct   struc ; (sizeof=0xF14)
00000000                 db ? ; undefined
00000001                 db ? ; undefined
00000002                 db ? ; undefined
[...same stuff...]
00000F11                 db ? ; undefined
00000F12                 db ? ; undefined
00000F13 field_F13       db ?
00000F14 custom_sturct   ends
00000F14

I'm using IDA Pro 6.3

NirIzr
  • 11,765
  • 1
  • 37
  • 87
vincentleest
  • 205
  • 3
  • 7
  • 1
    "but it is not working" -- what's "not working"? – Jason Geffner Jul 28 '15 at 21:47
  • applying the structure to ebp. – vincentleest Jul 28 '15 at 22:08
  • And are you editing the operand type for each mov [ebp+...], ... instruction as described in https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml? – Jason Geffner Jul 29 '15 at 00:39
  • 1
    You can't tell IDA "ebp is a structure pointer" and have every instruction that uses ebp use the structure automatically. You'll have to right-click each of the offsets, select "Structure offset" from the context menu, then select your custom_struct field. (Or, as a shortcut, use the T key). – Guntram Blohm Jul 29 '15 at 08:41
  • 1
    @JasonGeffner and @GuntramBlohm thank you both for your responses. After applying the "T" operation, IDA did not complain. However, the custom structure is still not showing up. I then realized that I gave ebp register a custom name. The custom_struct showed up after I've removed the custom name for the register. – vincentleest Jul 29 '15 at 14:37
  • 1
    @GuntramBlohm, want to create a new answer to this from your comment and mine? I'm happy for you to get the full credit for this one ;) – Jason Geffner Jul 29 '15 at 15:13
  • You can also try and use my Autostruct plugin. It allows to use Shift + T to convert multiple offsets at once instead of doing it line be line. Docs are here, code is available here. I've not tested in on 6.3, but it should work and save some time. – tmr232 Aug 01 '15 at 22:05
  • 1
    To add to @GuntramBlohm's comment: You can also select an area of text and hit t. A different menu will appear which will allow you to select a register (choose ebp) and a structure (choose custom_struct) and it will convert each offset from ebp within the selection to an offset of custom_struct. This works best in the linear view. – user1354557 Jan 11 '16 at 17:38

1 Answers1

8

To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit T. A pop up dialog called "Structure offsets" will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it.

Lets take the following code snippet taken from calc.exe for example:

Example of initial state

After selecting the relevant code and hitting T IDA automatically identified we're setting the ECX register, suggests possible valid structures to the left and the offsets and the selected structure's values.

Structure offsets dialog

After assigning a valid structure, the code looks like this:

code after structure offset assignment

Please notice the following caveats/remarks:

  1. IDA completely ignored the add ecx, 4 line and additionally did not handle the mov [ecx+eax*2], dx too well because of that. Hitting T for that specific line and suppling a non-zero offset delta will let you handle that properly, albeit manually.
  2. As mentioned in the comments, manually setting a register's name completely disables all IDA's representation of the register and instead displays the user supplied free text. This means any offset definitions will be hidden by any register custom name.
  3. If you've seen [ebp+0f14h], the structure's size is at least 0xF15 bytes, as the structure is being written to at offset 0x0F14, meaning at least 0xF15 bytes are available to it. If you've seen DWORD [ebp+0f14h] the structure is at least 0x0F18 bytes long.

Those caveats are at least partially mitigated by third party tools like Autostruct

NirIzr
  • 11,765
  • 1
  • 37
  • 87