3

I am working with IDA and I have the OpenProcess function receiving dwDesireAccess of 0x410:

enter image description here

According to MSDN we can see that 0x410 is the result of OR between two access rights:

PROCESS_QUERY_INFORMATION (0x0400)
PROCESS_VM_READ (0x0010)

How can I set a standard symbolic constant such as
PROCESS_QUERY_INFORMATION | PROCESS_VM_READ ?

I must do it manually (with "Manual...")?

This is only what I have:
enter image description here

5

You could create a bitfield enum. Since the enum containing PROCESS_VM_READ already exists in the MSSDK type library, we are going to copy that and modify it to become a bitfield.

  1. Go to the enums subview, then right click and Add enum... (press Insert on Windows). enter image description here

  2. Click Add standard enum by symbol name.
    enter image description here

  3. Find PROCESS_VM_READ, then click OK.
    enter image description here

  4. A new enum called MACRO_PROCESS should be added. Expand it (CtrlNumpad + or right click → Unhide)

  5. Delete the enum member PROCESS_ALL_ACCESS (press U when selecting it).
    enter image description here

  6. Right click and choose Edit enum... (CtrlE).

  7. Check Bitfield, then click OK. (This step will fail if you don't perform step 5) enter image description here

Now the MACRO_PROCESS bitfield should appear when you hit M on 410h, and should appear as something like

mov     eax, PROCESS_VM_READ or PROCESS_QUERY_INFORMATION
  • great answer ! Why you delete PROCESS_ALL_ACCESS ? – E235 Mar 3 '17 at 10:44
  • @E235: See step 7's description. – kennytm Mar 3 '17 at 13:58
  • Any idea why it will fail ? I want to understand because maybe I will have a case when I will need also this last parameter. – E235 Mar 4 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.