Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to set a comment on structures containing a member with a specific function pointer type. #196

Open
arizvisa opened this issue Jan 17, 2025 · 0 comments

Comments

@arizvisa
Copy link
Owner

In IDA 8.4, a certain combination of types applied to a structure member can result in the removal of comments applied to the members that follow it. After troubleshooting it, the type needs to be a function pointer that returns another function pointer. Something like the following will suffice:

00000000 struct busted // sizeof=0x20
00000000 {
00000000     __int64 field_0;                    // test 1
00000008     __int64 field_8;                    // test 2
00000010     __int64 field_10;                   // test 3
00000018     __int64 field_18;                   // test 4
00000020 };

If you apply the type __int64 (__fastcall ***(__fastcall *field_20)())(_QWORD) to "field_0", notice that the comments are shifted forward. Also notice that you're unable to set a comment on "field_8", since it gets applied to field_10.

00000000 struct busted // sizeof=0x20
00000000 {
00000000     __int64 (__fastcall ***(__fastcall *field_0)())(_QWORD); // test 1
00000008     __int64 field_8;
00000010     __int64 field_10;                   // test 2
00000018     __int64 field_18;                   // test 3
00000020 };

It turns out that the number of comments that get shifted depends on the parameters of the type being applied to "field_0". If you use the type __int64 (__fastcall ***(__fastcall *field_0)())(int, int), which contains two parameters, the next two fields will suffer the described symptom.

00000000 struct busted // sizeof=0x20
00000000 {
00000000     __int64 (__fastcall ***(__fastcall *field_0)())(int, int); // test 1
00000008     __int64 field_8;
00000010     __int64 field_10;
00000018     __int64 field_18;                   // test 2
00000020 };

This bug actually has nothing to do with the plugin and is only logged here for tracking a way to workaround the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant