There is a special kind of enums: bitfields. A bitfield is an enum divided into bit groups. When you define a new symbolic constant in a bitfield, you need to specify the group to which the constant will belong to. By default, IDA proposes groups containing one bit each. If a group is not defined yet, it is automatically created when the first constant in the group is defined. For example:
| Previous topic
| Next topic
name CONST1 value 0x1 mask 0x1will define a constant named CONST1 with value 1 and will create a group containing only one bit. Another example. Let's consider the following definitions:
#define OOF_SIGNMASK 0x0003 #define OOFS_IFSIGN 0x0000 #define OOFS_NOSIGN 0x0001 #define OOFS_NEEDSIGN 0x0002 #define OOF_SIGNED 0x0004 #define OOF_NUMBER 0x0008 #define OOF_WIDTHMASK 0x0030 #define OOFW_IMM 0x0000 #define OOFW_16 0x0010 #define OOFW_32 0x0020 #define OOFW_8 0x0030 #define OOF_ADDR 0x0040 #define OOF_OUTER 0x0080 #define OOF_ZSTROFF 0x0100How do we describe this?
name value mask maskname
OOFS_IFSIGN 0x0000 0x0003 OOF_SIGNMASK OOFS_NOSIGN 0x0001 0x0003 OOF_SIGNMASK OOFS_NEEDSIGN 0x0002 0x0003 OOF_SIGNMASK OOF_SIGNED 0x0004 0x0004 OOF_NUMBER 0x0008 0x0008 OOFW_IMM 0x0000 0x0030 OOF_WIDTHMASK OOFW_16 0x0010 0x0030 OOF_WIDTHMASK OOFW_32 0x0020 0x0030 OOF_WIDTHMASK OOFW_8 0x0030 0x0030 OOF_WIDTHMASK OOF_ADDR 0x0040 0x0040 OOF_OUTER 0x0080 0x0080 OOF_ZSTROFF 0x0100 0x0100If a mask consists of more than one bit, it can have a name and a comment. A mask name can be set when a constant with the mask is being defined. IDA will display the mask names in a different color.
In order to use a bitfield in the program, just convert an instruction operand to enum. IDA will display the operand like this:
mov ax, 70hwill be replaced by
mov ax, OOFS_IFSIGN or OOFW_8 or OOF_ADDRSee also Enum window