Bitfields
There is a special kind of enums:
bitfields. A bitfield is an enum where the 32bits are divided into groups.
When you define a new symbolic constant in a bitfield, you need to specify
the group to which the constant will belong to.
By default, IDA proposes groups containing one bit each.
If a group is not defined yet, it is automatically created
when the first constant in the group is defined. For example:
name CONST1 value 0x1 mask 0x1
will define a constant named CONST1 with value 1 and will create a group containing only one bit.
Another example. Let's consider the following definitions:
#define OOF_SIGNMASK 0x0003 #define OOFS_IFSIGN 0x0000 #define OOFS_NOSIGN 0x0001 #define OOFS_NEEDSIGN 0x0002 #define OOF_SIGNED 0x0004 #define OOF_NUMBER 0x0008 #define OOF_WIDTHMASK 0x0030 #define OOFW_IMM 0x0000 #define OOFW_16 0x0010 #define OOFW_32 0x0020 #define OOFW_8 0x0030 #define OOF_ADDR 0x0040 #define OOF_OUTER 0x0080 #define OOF_ZSTROFF 0x0100
How do we describe this?
name value mask maskname OOFS_IFSIGN 0x0000 0x0003 OOF_SIGNMASK OOFS_NOSIGN 0x0001 0x0003 OOF_SIGNMASK OOFS_NEEDSIGN 0x0002 0x0003 OOF_SIGNMASK OOF_SIGNED 0x0004 0x0004 OOF_NUMBER 0x0008 0x0008 OOFW_IMM 0x0000 0x0030 OOF_WIDTHMASK OOFW_16 0x0010 0x0030 OOF_WIDTHMASK OOFW_32 0x0020 0x0030 OOF_WIDTHMASK OOFW_8 0x0030 0x0030 OOF_WIDTHMASK OOF_ADDR 0x0040 0x0040 OOF_OUTER 0x0080 0x0080 OOF_ZSTROFF 0x0100 0x0100
If a mask consists of more than one bit, it can have a name and a comment.
A mask name can be set when a constant with the mask is being defined.
IDA will display the mask names in a different color.
In order to use a bitfield in the program, just convert an instruction operand to enum.
IDA will display the operand like this:
mov ax, 70h
will be replaced by
mov ax, OOFS_IFSIGN or OOFW_8 or OOF_ADDR