Igor’s Tip of the Week #170: Instantiating structures

Creating user-defined structures can be quite useful both in disassembly and pseudocode when dealing with code using custom types. However, they can be useful not only in code but also data areas.

MFC message maps

As an example, let’s consider an MFC program which uses message maps. These maps are present in the constant data area of the program and are initially represented by IDA as a mix of numbers and offsets:

To make sense of it, we can …

code data defined disassembly malware analysis maps message program pseudocode types week