Easy structure types

I’m happy to tell you that a new build of the decompiler is ready! It introduces new easily accessible commands to manipulate structure pointers. First, a variable can be converted into a structure pointer with one click. Also, new the structure types can be build on the fly by the decompiler. As usual, any type or name can be modified any time. All this makes using the decompiler really agreeable. Please watch a short demo:

This text is replaced by the Flash content.



Another nice improvement is how the decompiler handles zero offset fields in structure types. Below are two screenshots. Before:

After:

Please note that all casts has gone. They have been replaced by direct references to the first field of the structure type. Needless to say, the second text is much clearer than the first one.
As usual, all discovered and reported bugs have been fixed. If you have an old version, please update (especially before sending us bug reports).
Thank you!

This entry was posted in Decompilation. Bookmark the permalink.

9 Responses to Easy structure types

  1. dennis says:

    the structure creation feature is awesome!

  2. Ignatich says:

    Fantastic! This also means structure pointers as structure members are easy. I also hope HexRays/IDA learns to properly load structures (honoring alignment)from PDB files some day.
    Too bad I won’t be able to afford this product for a long time :(

  3. Ben says:

    Hi Ilfak,
    Great improvement to the Hex-Rays, it will improve the easy-of-use a lot.
    Regarding the zero offset in structures, will IDA be changed some time soon to show the field at offset 0, instead of just the structure name?
    I would personally prefer to have the field at offset zero shown, rather than ommitted, or to have the user have the choice of displaying either just the structure name or the structure name dot field at offset zero.
    Thanks for the great products, and thanks for your blog, I find I learn a lot of good tips from it.
    Cheers.
    Ben

  4. Ilfak Guilfanov says:

    Ben,
    Thank you for your kind words!
    In IDA, the user can decide if the zero offset field should be displayed. The command to accomplish it is not well known (a perfect example of a rarely used command): Edit, Struct, Force zero offset field. It can do miracles together with Edit, Struct, Select union member :)
    However, if anything doesn’t work or you have any remarks about IDA use, feel free to post a message on our forum!

  5. wilfredguerin says:

    Has the viability of using IDA as a cross-platform emulator and validator yet been addressed?
    Have ISO code validation criteria yet been met and where are the technical documents informing on such?
    And it would be good to create an abstract emulator language with full extrapolation from all hosts that can be optimized for runtime simulations (especially forward-porting)
    Let us know…

  6. Ilfak Guilfanov says:

    Please note that your message is offtopic here, however, just a quick note: yes, IDA can handle cross platform emulation. Our forum is a much better place for such inquiries.

  7. Ben says:

    Thanks for the IDA structure force zero offset field. I was unaware of it. Another great tip, thank you.

  8. Craig S. says:

    I have a problem with the structures feature (not in the C decompiltion, but in the regular debugger/disassembler). Sometimes, when I declare a structure variable, the bytes collapse. For example:

    ICON_32x32x4xpp < struct_members >

    However, othertimes the bytes do not collapse. For example, each structure member will appear as below:

    db     0x??        ; Struct_field_name0

    What is causing this? Is there a way to make sure structures always collapse on creation?

  9. Ilfak Guilfanov says:

    Please contact the Hex-Rays support for such questions, thank you.