Structs

This submenu allows you to manipulate the structures in specific operations. The following commands are accessible from the disassembly window.

• Struct var...

• Force zero field offset

• Select union member...

• Create struct from selection

• Copy field info to pointers...

Commands for creating, editing, and deleting the structures are available from the Local Types window.

Use regular commands to specify struct and union members, their types, comments, etc.

A union is a special kind of structure. Use structure definition commands to manipulate unions.

See also Edit submenu.

Declare a structure variable

 Action    name: MakeStructVar
 

This command declares a variable of the specified structure type.

IDA will ask you to choose a structure type. You must have some structure types defined in order to use this command.

If the target assembler supports it, IDA will display the structure in terse form (using just one line). To uncollapse a terse structure variable use the Unhide command.

You can also use this command to declare a structure field in another structure (i.e. nested structures are supported too).

Force zero field offset

 Action    name: ZeroStructOffset
 

This command forces IDA to display a full structure member name even if the offset of the member is equal to zero.

If used twice, the command cancels itself.

Example: Suppose we have the following structure:

        xxx     struc
        a       db ?
        b       db ?
        c       db ?
        xxx     ends

        dloc    xxx ?

  Normally IDA displays references to it like this:

        mov     eax, offset dloc
        mov     eax, offset dloc.b

  If you force IDA, then it displays member 'a':

        mov     eax, offset dloc.a
        mov     eax, offset dloc.b

Select union member

 Action    name: SelectUnionMember
 

This command tells IDA how to display references to a union from the current cursor location.

Example: Suppose we have the following union:

        xxx     union
        a       db ?
        b       dw ?
        c       dd ?
        ends   xxx

        dloc    xxx ?

  Normally, IDA displays references to "dloc" like this:

        mov     al,  byte ptr dloc
        mov     eax, word ptr dloc

  After using this command, IDA can display the union members:

        mov     al,  dloc.b
        mov     eax, dloc.d

Create a new structure from current data

Action    name: CreateStructFromData
 

This command defines a new structure from data already defined. The new structure is created with adequate data types, and each member uses the current data name if it is available.

This command is available only in the graphical version of IDA.

Copy field info to pointers

 Action    name: CopyFieldsToPointers
 

This command scans the current struct variable and renames the locations pointed by offset expressions unless they already have a non-dummy name.

It also copies the type info from the struct members to pointed locations.