Referencing variable fields outside of structure + placing it at offset

Question

Hey all,

Recently running into a problem with trying to define structure references that exist at different areas in the binary based on the info fields of previously seen structures. In particular, I'm trying to take an offset field i've defined in a 'Header' struct, and place another defined struct at that offset. For some reason I can't seem to find a way to do this, I've been messing around the layout of the grammar and couldn't find any documentation related to how to access special APIs for the fields of other structes (there was an example using "prev.size" in the tutorial).

Linked is a picture that hopefully explains better. Ideally I would want the "Image" struct to start at the file offset in 'image_offset' provided by the header, up to the length provided by 'image_size'. However currently they just occupy the space side by side, ignoring the offset field.

What would best practices be in this case?

http://imgur.com/a/X5t1k

Thanks!

Answer 1

Spontaneously I see nothing wrong, the offset element is exactly intended for such cases. Since offset elements can have forward references (in your case the length "image_size") they are parsed after the structure (in your case "Header").

Could you provide the grammar and a sample file?

What also might reveal some additional info is the debug log option. You can choose debug log in the log viewer of your "reference file", the one you're analyzing. Simply select to display all debug messages and let the file parse again (there's a button for this in the toolbar).