IDA Pro Labeling struct

Hi Everybody

In this post, I am going to write about labeling c struct which improve our assembly reading which make easier to do interpretation.

I am going to use the C code below

We see from the above code that we are using a C struct called bodyType which has two field those are weight and height. Both of the field is integer.

Here is the assembly code

main function
setdata function

we can see that in the setdata function IDA does not recognize the struct that we defined in C code. In order to improve our reading, we can define a struct in IDA so that IDA can recognize it.

First what you need to do is recognize where is the first object initiation. In the above code sample in setdata function we can see person is passed variable which is assigned address after EBP.

We can add new struct in IDA by going to struct window and press Ins or right click add struct type

struct window

A dialog box will appear like below, there you can add new struct name that you want to use

After you press OK button, You can see the struct skeleton appear like the picture above

Now to add field then you can press D. You can change the field name by pressing N.

there are three types of declaration
dd = Defined Double Word 4 Bytes in x86 32 bit system
db = Defined Byte 8 bits
dw = Defined Words = Generally 2 bytes on typical x86 32 bits system

So based on our observation that our data are integer then dd is good enough 4 Bytes

OK.. after we defined our struct declaration then we can assign our code to struct by pressing T to the code

You can select MyStruct.Weight+4 then the code will be changed to become like this below. Basically IDA will detect that when EAX is MyStruct then EAX + 4 it means it will suggest us field with offset 4 that is height as seen below

how about the weight ? for the code below

IDA will suggest to use the first field since it has no offset such as height EAX+4. So the suggestion will be like below

so after we assign struct the code is much easier to be read like code below

OK .. that is it .. for struct assignment. I will later talk about C++ Class.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s