In the past, we’ve seen how structure instance representation can be changed by editing the structure in the Structures window. In IDA 8.4, a new unified view was introduced for Local Types and the same operations can (and should) be done in that window. Instead of comments, additional custom attributes are printed now:
In addition […]
In one of the past tips we mentioned the __unused attribute which can be applied to function arguments. When can it be useful?
Let’s consider this code from Apple’s dyld:
v19 is passed as fist argument to dyld4::ProcessConfig::PathOverrides::setString(). Since its name looks like a class method, the decompiler assigned the class type to the first argument […]
Previously, we discussed a situation where the decompiler wrongly used a combined stack slot for two separate variables. We could solve it because each variable had a distinct stack location, so editing the stack frame to split them worked.
However, modern optimizing compilers can actually reuse the same stack location for different variables active at […]
As we’ve seen previously, an IDB (IDA database) consists of several embedded files which contain the actual database data and which IDA reads/write directly when working with the database. By default, they’re unpacked next to the IDB, which can lead to various issues such as excessive disk usage, or speed (e.g. if IDB is […]
When you work in IDA, it saves the results of your analysis in the IDA Database, so that you can pause and continue at a later time. You can recognize the database files by their file extension .idb (for legacy, 32-bit IDA) or .i64 (for 64-bit IDA or IDA64). Thus they’re also often called just […]
Previously we’ve seen how to do small edits to types directly from the pseudocode view. While this is enough for minor edits, sometimes you still need to use the full editor.
Of course, it is always possible to open Structures, Enums, or Local Types and look for your type there, but what if you have […]
We already know that user-defined types such as structures and enums can be created and edited through the corresponding views, or the Local Types list.
However, some small edits can be performed directly in the pseudocode view:
structure fields can be renamed using the “Rename” action (shortcut N):
you can also quickly retype them using […]
We’ve seen how custom structures can be used to format data tables nicely, but sometimes you can improve your understanding even further with small adjustments. For example, in the structure we created, the first member (nMessage) is printed as a simple integer:
If you know Win32 API well, you may recognize that these numbers correspond […]
Creating user-defined structures can be quite useful both in disassembly and pseudocode when dealing with code using custom types. However, they can be useful not only in code but also data areas.
MFC message maps
As an example, let’s consider an MFC program which uses message maps. These maps are present in the constant […]
When you load a file into IDA, whether a standard executable format (e.g. PE, ELF, Macho-O), or a raw binary, IDA assigns a particular address range to the data loaded from it, either from the file’s metadata or user’s input (in case of binary file). The lowest address from those occupied by the file […]