How to apply types to static pointers?

IDA General
1

I’m using IDA pro 9.0, and the program I’m reversing directly accesses KUSER_SHARED_DATA for anti-debugging purposes. The issue I’m facing though is I can’t apply a type to the base of the struct and have it recognized anywhere except the exact address I set the type on. Here is an example below of the code I’m working with. This is a decompiled x86 DLL, targeting Windows 10.

// IF: TickCountMultiplier * (TickCount.High1Time << 8) + (TickCount.LowPart * TickCountMultiplier) >> 24
// ELSE: (TickCountLow * TickCountMultiplier) >> 24

if ( MEMORY[0x7FFE0320] | MEMORY[0x7FFE0328] ) 
   v3 = MEMORY[0x7FFE0004] * (MEMORY[0x7FFE0324] << 8) + ((MEMORY[0x7FFE0320] * (unsigned __int64)MEMORY[0x7FFE0004]) >> 24);
else 
   v3 = (MEMORY[0x7FFE0004] * (unsigned __int64)MEMORY[0x7FFE0000]) >> 24;

I want to apply the type KUSER_SHARED_DATA to it’s base of 0x7FFE0000 (this address does not change across processes), but when I do set the type, ONLY 0x7FFE0000 is recognized as part of the struct, so I have to manually calculate offsets to each variable. Any advice is greatly appreciated!

2

create an additional segment with address range

4 Likes