3

I am working with IDA and I have the OpenProcess function receiving dwDesireAccess of 0x410:

enter image description here

According to MSDN we can see that 0x410 is the result of OR between two access rights:

PROCESS_QUERY_INFORMATION (0x0400)
PROCESS_VM_READ (0x0010)

How can I set a standard symbolic constant such as
PROCESS_QUERY_INFORMATION | PROCESS_VM_READ ?

I must do it manually (with "Manual...")?

This is only what I have:
enter image description here

1 Answer 1

5

You could create a bitfield enum. Since the enum containing PROCESS_VM_READ already exists in the MSSDK type library, we are going to copy that and modify it to become a bitfield.

  1. Go to the enums subview, then right click and Add enum... (press Insert on Windows). enter image description here

  2. Click Add standard enum by symbol name.
    enter image description here

  3. Find PROCESS_VM_READ, then click OK.
    enter image description here

  4. A new enum called MACRO_PROCESS should be added. Expand it (CtrlNumpad + or right click → Unhide)

  5. Delete the enum member PROCESS_ALL_ACCESS (press U when selecting it).
    enter image description here

  6. Right click and choose Edit enum... (CtrlE).

  7. Check Bitfield, then click OK. (This step will fail if you don't perform step 5) enter image description here

Now the MACRO_PROCESS bitfield should appear when you hit M on 410h, and should appear as something like

mov     eax, PROCESS_VM_READ or PROCESS_QUERY_INFORMATION
4
  • great answer ! Why you delete PROCESS_ALL_ACCESS ?
    – E235
    Mar 3, 2017 at 10:44
  • @E235: See step 7's description.
    – kennytm
    Mar 3, 2017 at 13:58
  • Any idea why it will fail ? I want to understand because maybe I will have a case when I will need also this last parameter.
    – E235
    Mar 4, 2017 at 21:08
  • I think the problem is the intersecting masks (which I think default to the values themselves). If in the code you ever have the value 1F0FFFh, it will be replaced by a bitwise OR of all other constants. You could also define it as a standalone constant (e.g. an enum containing only that, might be a better way). Unless there are some hidden options here, this bitfields feature feels a bit unfinished (unless you don't have any duplicates or intersections). Mar 24, 2022 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.