Igor’s Tip of the Week #125: Structure fields representation

When dealing with structure instances in disassembly, sometimes you may want to change how IDA displays them, but how to do it is not always obvious. Let’s have a look at some examples.

Win32 section headers

Let’s say you have loaded the PE file header using manual load, or found an embedded PE file in your binary, and want to format its PE header nicely. Thanks to the standard type libraries, you can import standard Win32 structures such …

binary change disassembly embedded file header headers ida malware analysis may representation standard win32