Commands of this submenu are available in the structures window. Only Declare struct var... is available in the disassembly window.
Use regular commands to specify struct and union members, their types, comments, etc.
A union is a special kind of structure. Use structure definition commands to manipulate unions.
See also Edit submenu.
This command defines a new structure or a new union. The new structure is created with zero length. You will have to add structure members using structure manipulation commands.
If the entered structure name denotes a standard structure type from a loaded type library, then its definition will be automatically used. In this case, the value of the 'create union' checkbox will be ignored.
This command is available when you open a structures window.
You can add new members to the structure using the following commands: command hotkey ------- ------ make data D make strlit A make array * rename N You may also insert/delete undefined bytes into the middle of the structure by using expand and shrink commands.
"Create before current structure" means that the new structure will be placed immediately before the current structure type. Otherwise, the new structure is placed after the current structure.
"Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition, for example, when he creates a variable of this structure type. We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.
See also How to Enter an Identifier.
This command makes a copy of the current structure type. The new structure type will have the same members as the current one but its name will be autogenerated (something like struc_333)
By default the new structure type will be placed after the current structure type.
This command deletes the current structure. Beware, when you delete a structure, all references to it will be destroyed as well. Even if you recreate it later, you'll have to specify again all references to it.
You may use this command to delete unions also.
This command is available when you open a structures window.
This command expands the current structure by inserting undefined bytes at the cursor location. The cursor must not be at the end of the structure. To define a member at the end of the structure, just use normal data definition commands.
This command is available when you open a structure window.
This command shrinks the current structure by deleting undefined bytes at the cursor location. The cursor must be at an undefined byte. IDA will ask the user the number of bytes to remove.
This command is available when you open a structure window.
This command allows the user to change the structure alignment
Structure alignment is used to calculate the number of padding bytes at the end of the structure. For example, if alignment is 4 and the last field is a byte at offset 11h, IDA will add 3 bytes of padding so that the struct size is 14h (multiple of 4).
The alignment must be a power of 2.
This command is available in the Structures window.
See also How to Enter a Number.
This command declares a variable of the specified structure type.
IDA will ask you to choose a structure type. You must have some structure types defined in order to use this command.
If the target assembler supports it, IDA will display the structure in terse form (using just one line). To uncollapse a terse structure variable use the Unhide command.
You can also use this command to declare a structure field in another structure (i.e. nested structures are supported too).
This command forces IDA to display a full structure member name even if the offset of the member is equal to zero.
If used twice, the command cancels itself.
Example: Suppose we have the following structure:
This command tells IDA how to display references to a union from the current cursor location.
Example: Suppose we have the following union:
This command defines a new structure from data already defined. The new structure is created with adequate data types, and each member uses the current data name if it is available.
This command is available only in the graphical version of IDA.
This command scans the current struct variable and renames the locations pointed by offset expressions unless they already have a non-dummy name.
It also copies the type info from the struct members to pointed locations.
Commands of this submenu are available in the enums window:
All enum members names must be unique in the program. You cannot define more than 256 enum members (symbolic constants) with the same value.
Please note that you can create bitfield definitions here.
You can also add a comment for the enum and for each enum member. In order to specify an enum comment, you must stand at the enum name. Comments are set using regular commands:
See also Edit submenu.
These commands allow you to define and to edit an enum type. You need to specify:
Each enum has its ID and a serial number. The ID is a number used to refer to the enum, while a serial number is used to order enums during output. Changing the serial number moves the enum to another place.
The serial number of an enum is displayed at the lower left corner of the window.
You can specify any number as a serial number, IDA will move the enum to the specified place.
You also need to specify representation of enum constants. You may choose from various number bases (hex,dec,oct,bin) and character constants.
You may specify the element width or leave it zero. Zero means the element width is not specified. The allowed widths are the powers of 2 in the range of 1..64.
Please note that you can create bitfield definitions here by checking the "bitfield" checkbox.
These command is available when you open the enums window.
See also How to Enter a Number.
This command deletes the current enum. Beware, when you delete an enum all references to it will be destroyed. Even if you recreate it later, you'll have to specify again all references to it.
This command is available when you open the enums window.
This command allows you to define an enum member. An enum member is a symbolic constant. You have to specify its name and value. You cannot define more than 256 constants with the same value in an enum.
If the current enum is a bitfield, you need to specify the bitmask. To learn about bitmasks, read about bitfields.
This command allows you to rename an enum member. An enum member is a symbolic constant. Its name must be unique in the program.
To rename an enum type name, position the cursor over the name of the enum.
Please remember that deleting a member also deletes all the information about the member, including comments, member name etc.
There is a special kind of enums: bitfields. A bitfield is an enum divided into bit groups. When you define a new symbolic constant in a bitfield, you need to specify the group to which the constant will belong to. By default, IDA proposes groups containing one bit each. If a group is not defined yet, it is automatically created when the first constant in the group is defined. For example:
will define a constant named CONST1 with value 1 and will create a group containing only one bit. Another example. Let's consider the following definitions:
How do we describe this?
If a mask consists of more than one bit, it can have a name and a comment. A mask name can be set when a constant with the mask is being defined. IDA will display the mask names in a different color.
In order to use a bitfield in the program, just convert an instruction operand to enum. IDA will display the operand like this:
will be replaced by
See also Enum window and Bitfields tutorial