You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In IDA 8.4, a certain combination of types applied to a structure member can result in the removal of comments applied to the members that follow it. After troubleshooting it, the type needs to be a function pointer that returns another function pointer. Something like the following will suffice:
00000000 struct busted // sizeof=0x20
00000000 {
00000000 __int64 field_0; // test 1
00000008 __int64 field_8; // test 2
00000010 __int64 field_10; // test 3
00000018 __int64 field_18; // test 4
00000020 };
If you apply the type __int64 (__fastcall ***(__fastcall *field_20)())(_QWORD) to "field_0", notice that the comments are shifted forward. Also notice that you're unable to set a comment on "field_8", since it gets applied to field_10.
It turns out that the number of comments that get shifted depends on the parameters of the type being applied to "field_0". If you use the type __int64 (__fastcall ***(__fastcall *field_0)())(int, int), which contains two parameters, the next two fields will suffer the described symptom.
In IDA 8.4, a certain combination of types applied to a structure member can result in the removal of comments applied to the members that follow it. After troubleshooting it, the type needs to be a function pointer that returns another function pointer. Something like the following will suffice:
If you apply the type
__int64 (__fastcall ***(__fastcall *field_20)())(_QWORD)
to "field_0", notice that the comments are shifted forward. Also notice that you're unable to set a comment on "field_8", since it gets applied to field_10.It turns out that the number of comments that get shifted depends on the parameters of the type being applied to "field_0". If you use the type
__int64 (__fastcall ***(__fastcall *field_0)())(int, int)
, which contains two parameters, the next two fields will suffer the described symptom.This bug actually has nothing to do with the plugin and is only logged here for tracking a way to workaround the issue.
The text was updated successfully, but these errors were encountered: