3

Is there a way in ghidra to change decompiled switch statement case values to their names?

I'm looking at a WndProc function, with a prototype of LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam). Inside the function are a number of switch statements based on the msg UINT, which ghidra calls param_2. The uint values are defined in winuser.h. I want to change all the spots param_2 is compared in the decompilation so it uses the winuser.h names instead of the uint values, for example, change if (param_2 != 0x100) to if (param_2 != WM_KEYDOWN), for all the param_2 checks in a given function.

2 Answers 2

2

Found the answer here: IDA Tips - Strings + Parameters

In the disassembly, right click the constant, click Set Equate... and select the appropriate type. You may have to load (or create and load) the appropriate gdt file first.

1

Besides manually changing each case, with some measure of success depending on the logic for the switch, the best way is to create an enum type (it must be sized correctly) with all the values you'd like to see, and then cast param_2 to that enum type.

I don't do many Windows RE, so I'm not certain on how Ghidra has those values available currently, it might already exist in their windows libraries as an enum, though it might be a bunch of individual defines that you might to need to manually create into an enum to use like you're wanting.

1
  • Added some more details. The type is correct, the value is UINT, and the values are all #defines coming from winuser.h. Im wondering if theres an easy way to tell ghidra those come from winuser, and apply the defines appropriately
    – gr0k
    Commented Mar 6, 2021 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.