Structures

Commands of this submenu are available in the structures window. Only Declare struct var... is available in the disassembly window.

Use regular commands to specify struct and union members, their types, comments, etc.

A union is a special kind of structure. Use structure definition commands to manipulate unions.

Define a new structure

 Action    name: AddStruct

This command defines a new structure or a new union. The new structure is created with zero length. You will have to add structure members using structure manipulation commands.

If the entered structure name denotes a standard structure type from a loaded type library, then its definition will be automatically used. In this case, the value of the 'create union' checkbox will be ignored.

This command is available when you open a structures window.

You can add new members to the structure using the following commands: command hotkey ------- ------ make data D make strlit A make array * rename N You may also insert/delete undefined bytes into the middle of the structure by using expand and shrink commands.

"Create before current structure" means that the new structure will be placed immediately before the current structure type. Otherwise, the new structure is placed after the current structure.

"Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition, for example, when he creates a variable of this structure type. We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.

Duplicate a structure type

Action    name: CopyStruct

This command duplicate the current structure type. The new structure type will have the same members as the current one but its name will be autogenerated (something like struc_333)

By default the new structure type will be placed after the current structure type.

Delete a structure

 Action    name: DelStruct

This command deletes the current structure. Beware, when you delete a structure, all references to it will be destroyed as well. Even if you recreate it later, you'll have to specify again all references to it.

You may use this command to delete unions also.

This command is available when you open a structures window.

Expand a structure

 Action    name: ExpandStruct

This command expands the current structure by inserting undefined bytes at the cursor location. The cursor must not be at the end of the structure. To define a member at the end of the structure, just use normal data definition commands.

This command is available when you open a structure window.

Shrink a structure

 Action    name: ShrinkStruct

This command shrinks the current structure by deleting undefined bytes at the cursor location. The cursor must be at an undefined byte. IDA will ask the user the number of bytes to remove.

This command is available when you open a structure window.

Edit a structure

 Action    name: EditStruct

This command allows the user to change the structure alignment

Structure alignment is used to calculate the number of padding bytes at the end of the structure. For example, if alignment is 4 and the last field is a byte at offset 11h, IDA will add 3 bytes of padding so that the struct size is 14h (multiple of 4).

The alignment must be a power of 2.

This command is available in the Structures window.

Declare a structure variable

 Action    name: MakeStructVar

This command declares a variable of the specified structure type.

IDA will ask you to choose a structure type. You must have some structure types defined in order to use this command.

If the target assembler supports it, IDA will display the structure in terse form (using just one line). To uncollapse a terse structure variable use the Unhide command.

You can also use this command to declare a structure field in another structure (i.e. nested structures are supported too).

Force zero field offset

 Action    name: ZeroStructOffset

This command forces IDA to display a full structure member name even if the offset of the member is equal to zero.

If used twice, the command cancels itself.

Example: Suppose we have the following structure:

        xxx     struc
        a       db ?
        b       db ?
        c       db ?
        xxx     ends

        dloc    xxx ?

  Normally IDA displays references to it like this:

        mov     eax, offset dloc
        mov     eax, offset dloc.b

  If you force IDA, then it displays member 'a':

        mov     eax, offset dloc.a
        mov     eax, offset dloc.b

Select union member

 Action    name: SelectUnionMember

This command tells IDA how to display references to a union from the current cursor location.

Example: Suppose we have the following union:

        xxx     union
        a       db ?
        b       dw ?
        c       dd ?
        ends   xxx

        dloc    xxx ?

  Normally, IDA displays references to "dloc" like this:

        mov     al,  byte ptr dloc
        mov     eax, word ptr dloc

  After using this command, IDA can display the union members:

        mov     al,  dloc.b
        mov     eax, dloc.d

Create a new structure from current data

Action    name: CreateStructFromData

This command defines a new structure from data already defined. The new structure is created with adequate data types, and each member uses the current data name if it is available.

This command is available only in the graphical version of IDA.

Copy field info to pointers

 Action    name: CopyFieldsToPointers

This command scans the current struct variable and renames the locations pointed by offset expressions unless they already have a non-dummy name.

It also copies the type info from the struct members to pointed locations.

Last updated 3 days ago