Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums?
For instance, I have the following enums,
HTTP_QUERY_CONNECTION has the value 23 and
HTTP_QUERY_FLAG_REQUEST_HEADERS has the value 0x80000000
I would like to change the code which has the value 0x80000023 into
HTTP_QUERY_CONNECTION | HTTP_QUERY_FLAG_REQUEST_HEADERS
Is that modification possible in IDA?
Yes, it is possible. The enum must be set to the 'bitfield' kind, and the bit masks must be set appropriately. Position the cursor on the enum name (in the Enums view) and hit Ctrl-N; in the lower left corner of the dialogue that appears there's a check box named "Bitfield".
If all values are independent then the bitmask for each value is the value itself; if there are sub fields that contain enumerated values then those must have the same mask. I don't know the exact details for HttpQueryInfo() so I'm using a mask of 0xFFFF for the enumerated part and assume that the upper 16 bits are independent flags. What you need is something like this:
HTTP_QUERY_FLAG_REQUEST_HEADERS value 0x80000000 mask 0x80000000
HTTP_QUERY_CONTENT_TYPE value 1 mask 0x0000FFFF
...
HTTP_QUERY_CONNECTION value 23 mask 0x0000FFFF
HTTP_QUERY_ACCEPT value 24 mask 0x0000FFFF
...
However, it can be extremely difficult to modify an existing enum. You can't switch the enum to 'bitfield' if there are values that need masking ('blah is hindering' or some such rot), but if the enum isn't set to 'bitfield' then IDA doesn't let you set the masks for the enum members. Best to build a new enum from scratch.
