PDA

View Full Version : [IDA Pro] Add C structures for HexRays decompiler



kung foo man
12th April 2016, 00:25
A) View -> Open subviews -> Structures

1075

B) Gonna see this window:

1076

C) Edit -> Add struct type

1077

D) Just enter a name, e.g. msg_t

1078

E) Now we have this empty structure, we can't work further on it in "Local Types" window, so we need to add at least one element to it.

Add one element by clicking once on msg_t and press d multiple times (it will circle 1, 2, 4 bytes iirc, just let it on 4 bytes e.g.)

1079

If you don't add an element, the "Local Types" window will show this (or I fucked up my IDA on some previous attempts...):

1080

F) Should look like this now:

1081

G) Now go to "Local Types" window

1082

H) Right-click on msg_t and click "Edit..."

1083

I) It will look like this first:

1084

J) Just enter the structure as in Quake3 or RTCW/ET:

1085

K) Now it will look like this:

1086

L) Decompile some function using msg_t, e.g. MSG_WriteByte:

1087

Click once on a1, press y, and change the type to msg_t *msg.

M) Tada, we have some nicely decompiled function, way easier to read:

1088