Igor’s Tip of the Week #161: Extracting substructures

As covered before, the action “Create struct from selection” can be used to quickly create structures from existing data items.

However, Disassembly view not the only place where it can be used. For example, let’s imagine you’ve created a structure to represent some context used by the binary being analyzed:

00000000 Context         struc ; (sizeof=0x1C)
00000000 version         dd ?
00000004 pid             dd ?
00000008 tid             dd ?
0000000C listhead        dd ?                    ; offset
00000010 listtail        dd ?                    ; offset
00000014 count           dd ?
00000018 filename        dd ?
0000001C Context         ends

But as you analyze the code further, you realize that the list structure is generic and is used in other places independently. In this simple scenario you can, of course, create a separate List structure and replace the fields inside Context with it, but what if the substructure is big and contains hundreds of fields? Using “Create struct from selection” allows you to perform the task easily and quickly:

select the subset of fields you want to extract;
invoke the action
rename the new structure and/or fields as necessary.

Extracting structures from the stack frame

One more place where this action can be used is the stack frame view, because internally it is a kind of a structure.