3

This is just a simple questions regarding the hex values passed as dwFlags and translating them to their actual meaning. I found this thread (http://www.woodmann.com/forum/archive/index.php/t-12498.html) which nearly solves the problem but I'm still a little stuck.

As I understand it we should be right clicking and using Standard Symbolic Symbol.

Now this works fine for a single value (for example, the #define INTERNET_FLAG_FORMS_SUBMIT 0x00000040 in the referenced thread). But for multiple OR'd values, it doesn't help (at least the way I'm using it and that well may be wrong!)

Currently I'm looking at a call to HttpOpenRequestA where the dwFlags value is 4003300h. I was wondering if there was a way in IDA (or another utility that I could use) to translate that into it's actual meaning

INTERNET_FLAG_RAW_DATA 0x40000000
INTERNET_FLAG_IGNORE_CERT_DATE_INVALID 0x2000
INTERNET_FLAG_IGNORE_CERT_CN_INVALID 0x1000
INTERNET_FLAG_NO_UI 0x200
INTERNET_FLAG_PRAGMA_NOCACHE 0x100

Sure it is possible to do it manually but I was wondering if there was a way to integrate this functionality into IDA or something else.

I did post this to Woodmann's (http://www.woodmann.com/forum/showthread.php?15662-Question-about-dwFlags-and-IDA-(or-any-simple-way-to-translate-dwFlags)) and got an interesting response from a user there by the name of Kayaker, who has come up with one way to do it with IDA, but my understanding of this approach is that it would be horrendously time consuming and massive.

So - is there a way to do this automagically in IDA or is there another tool that someone may recommend?

  • Welcome to Reverse Engineering! Please read the short, friendly introductory tour. Formatting help is available by clicking the small ? in the tool bar, and even more is available in the Help center. – usr2564301 May 28 '15 at 21:26
3

This is very possible in IDA, using bitfield-enums.

  1. Assign an enum type to your value. If you use standard symbolic constant, there will be a local copy of the type in your Enumerations subview.

  2. Edit the enum type definition, and enable the bitfield checkbox. IDA will convert the bitfield automatically if all the enum values have only 1 bit set. If there are other values like zero, you have to remove them first.

  3. The value will now display similar to (INTERNET_FLAG_RAW_DATA or INTERNET_FLAG_IGNORE_CERT_DATE_INVALID or INTERNET_FLAG_IGNORE_CERT_CN_INVALID or INTERNET_FLAG_NO_UI or INTERNET_FLAG_PRAGMA_NOCACHE).

There is also support for more complicated multi-bit flags using masks. Read the Enum docs in IDA for more.

1

You could write a program to create the database Kayaker proposed. For example, spider through all API function pages on MSDN, try to scrape flag names for each function's parameter, look up those flags' values in the SDK's header files, and associate them with the API function in a database. You'd then need to write an IDA plugin to figure out the flag combinations for OR'ed flag values.

my understanding of this approach is that it would be horrendously time consuming and massive.

Yes, which is why nobody has ever done it :)

Many of us have considered doing it, but then realized that it's just not worth all the effort given that it's not too time-consuming to manually extract the symbolic flag values when we see them.

So if it makes you feel better, there's no tool out there that does this already -- you're not missing out on some secret tool that everyone else is using.

  • "Nobody" ... I converted Borland's old WinHelp Windows API guide to RTF, converted that to plain text, and weeded out all function prototypes and constants with search-and-replace, then used that data file in one of my disassemblers. (It was a pretty pointless operation as probably 99% of those functions were already obsolete for my then-used version of Windows--as I only found out when using that humongous list.) – usr2564301 May 28 '15 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.