Coalesce Enums in IDA?

Question

Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums?

For instance, I have the following enums,

HTTP_QUERY_CONNECTION has the value 23 and 
HTTP_QUERY_FLAG_REQUEST_HEADERS has the value 0x80000000

I would like to change the code which has the value 0x80000023 into

HTTP_QUERY_CONNECTION | HTTP_QUERY_FLAG_REQUEST_HEADERS

Is that modification possible in IDA?

Answer 1

Yes, it is possible. The enum must be set to the 'bitfield' kind, and the bit masks must be set appropriately. Position the cursor on the enum name (in the Enums view) and hit Ctrl-N; in the lower left corner of the dialogue that appears there's a check box named "Bitfield".

If all values are independent then the bitmask for each value is the value itself; if there are sub fields that contain enumerated values then those must have the same mask. I don't know the exact details for HttpQueryInfo() so I'm using a mask of 0xFFFF for the enumerated part and assume that the upper 16 bits are independent flags. What you need is something like this:

HTTP_QUERY_FLAG_REQUEST_HEADERS value 0x80000000 mask 0x80000000

HTTP_QUERY_CONTENT_TYPE         value          1 mask 0x0000FFFF
...
HTTP_QUERY_CONNECTION           value         23 mask 0x0000FFFF
HTTP_QUERY_ACCEPT               value         24 mask 0x0000FFFF
...

However, it can be extremely difficult to modify an existing enum. You can't switch the enum to 'bitfield' if there are values that need masking ('blah is hindering' or some such rot), but if the enum isn't set to 'bitfield' then IDA doesn't let you set the masks for the enum members. Best to build a new enum from scratch.