Question Regarding Interpreting DWARF Structure Information (nested structs?)

Discussion in 'Technical Discussion' started by Travelsonic, May 26, 2021.

  1. Travelsonic

    Travelsonic

    Member
    820
    17
    18
    (OK, I have no idea how to title this post, and my question, bear with me)

    So in this DWARF debugging data I am looking at for Dance Dance Revolution EXTREME (US - retail release, not one of the two protos that exist), I've noticed there are a lot of structures with a "@anon" (followed by some number) for the name.

    Perhaps this is a dumb question, but would the DIEs for these structures be, essentially, representative of anonymous structures, and in some cases, also representative of nested structure?

    Suppose you saw two data structures that were something like this:

    struct _anon1{

      signed int a;

      signed char b;

    };

    struct foo{

      _anon1 bar;

      signed char c;

    };

    Would it be safe (or unsafe) to assume the structure would have originally been like this?

    struct foo{

      struct{

        signed int a;

        signed char b;

     }bar;

     signed char c;

    };


    If this is correct, would that mean a struct with the "@anon(number)" naming convention that had another structure with this "@anon(number)" naming convention as a member is a nested structure within a nested structure?

    Part of my wrapping my head around this, on top of making sure that any disassembly I work on is as accurate as possible, is figuring out the best naming conventions for these structures in something like ghidra (the use of which I am still relatively new to, so I've not yet gotten into the intermediate and advanced features so to speak) - since each source code file had its own set of these nested structures.

    If I were to implement one struct and call it _anon6 to represent a nested structure that was originally used in a struct in les.c and called @anon6, and then implement another struct and call it __anon6 to represent a nested structure that was originally used in a struct in onimode.c, and also called @anon6, that could get confusing very quickly.

    (OFC it'd be a lot easier if either I could figure out how to define nested structs in the structure editor while editing the struct that has the nested structure as a member, IF that is EVEN doable ... or, if that isn't possible, can you parse a C source file and have it produce structs and other data structures \*reliably\*?

    I feel silly, but I don't learn unless I ask, eh?
     
    Last edited: May 26, 2021