Hex-Rays and negative structure offsets
I have the following structure definitions:
Code:
#pragma pack(push, 1) Code:
void __thiscall VertClass::Reset(VertClass *this) |
Find your struct in Local Types and Edit it. See if it matches what you think it should be. Find you struct in Structures, open it up with ctrl-+ and you'll see all your struct members and their offsets (sorry, I'm sure you know all this). My point is - alignment. It can easily be diffent to what you think. If you are inputing your structs to IDA as a *.h file, rather than directly into Local Types, then there is an even bigger chance of the alignment beig different. I'm never sure if alignment directives in *.h files fed to IDA get interpretted or not, IDA often seems to align struct member of a 4 byte boundary for a 32 bit PE and 8 bytes for a 64bit PE.
Actually, I'm wondering... you *did* give IDA your struct definitions, yes? Git |
Well Ida has analyzed and defined in the stack setup:
Code:
int *v1; // edi Code:
struct SomeStruct |
Did you post the orginal C source of that function, hexrays can recognize negative offset, but need to known the sharp of struct, http://www.hexblog.com/?p=63
|
All times are GMT +8. The time now is 18:23. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX