4

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode the flags value as an OR-ed expression of known mnemonics, e.g. MAP_SHARED|MAP_PRIVATE (as in man page of mmap). can there anything can be done to help IDA display that (apart from writing a plugin myself, of course)?

3

In IDA, you can define enums through the Enums view (shift+F10). Enums have the "bitfield" bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be set for enums with overlapping member bits.

Once an enum is a bitfield enum, setting any operand in the disassembly view to that enum will display all enum members of bit values set in the immediate operand.

If a function prototype uses an enum name for a variable type, IDA will try setting operands using it to the same enum automatically, although that does not always happen.

IIRC the MAP enum is already mapped in IDA's known enums, so adding it should be easy and without the need to manually define it.

  • Those flags are define in preprocessor #define. So a header file has to be created with enums. – Biswapriyo Jul 8 '18 at 14:04
  • I'll edit that in, IIRC that enum specifically is defined in IDA's type libraries. – NirIzr Jul 8 '18 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.