This is just a simple questions regarding the hex values passed as dwFlags and translating them to their actual meaning. I found this thread (http://www.woodmann.com/forum/archive/index.php/t-12498.html) which nearly solves the problem but I'm still a little stuck.

As I understand it we should be right clicking and using Standard Symbolic Symbol.

Now this works fine for a single value (for example, the #define INTERNET_FLAG_FORMS_SUBMIT 0x00000040 in the referenced thread). But for multiple OR'd values, it doesn't help (at least the way I'm using it and that well may be wrong!)

Currently I'm looking at a call to HttpOpenRequestA where the dwFlags value is 4003300h. I was wondering if there was a way in IDA (or another utility that I could use) to translate that into it's actual meaning


Sure it is possible to do it manually but I was wondering if there was a way to integrate this functionality into IDA or something else.

I did post this to Woodmann's (http://www.woodmann.com/forum/showthread.php?15662-Question-about-dwFlags-and-IDA-(or-any-simple-way-to-translate-dwFlags)) and got an interesting response from a user there by the name of Kayaker, who has come up with one way to do it with IDA, but my understanding of this approach is that it would be horrendously time consuming and massive.

So - is there a way to do this automagically in IDA or is there another tool that someone may recommend?

  • Welcome to Reverse Engineering! Please read the short, friendly introductory tour. Formatting help is available by clicking the small ? in the tool bar, and even more is available in the Help center.
    – Jongware
    May 28, 2015 at 21:26

2 Answers 2


This is very possible in IDA, using bitfield-enums.

  1. Assign an enum type to your value. If you use standard symbolic constant, there will be a local copy of the type in your Enumerations subview.

  2. Edit the enum type definition, and enable the bitfield checkbox. IDA will convert the bitfield automatically if all the enum values have only 1 bit set. If there are other values like zero, you have to remove them first.


There is also support for more complicated multi-bit flags using masks. Read the Enum docs in IDA for more.


You could write a program to create the database Kayaker proposed. For example, spider through all API function pages on MSDN, try to scrape flag names for each function's parameter, look up those flags' values in the SDK's header files, and associate them with the API function in a database. You'd then need to write an IDA plugin to figure out the flag combinations for OR'ed flag values.

my understanding of this approach is that it would be horrendously time consuming and massive.

Yes, which is why nobody has ever done it :)

Many of us have considered doing it, but then realized that it's just not worth all the effort given that it's not too time-consuming to manually extract the symbolic flag values when we see them.

So if it makes you feel better, there's no tool out there that does this already -- you're not missing out on some secret tool that everyone else is using.

  • 1
    "Nobody" ... I converted Borland's old WinHelp Windows API guide to RTF, converted that to plain text, and weeded out all function prototypes and constants with search-and-replace, then used that data file in one of my disassemblers. (It was a pretty pointless operation as probably 99% of those functions were already obsolete for my then-used version of Windows--as I only found out when using that humongous list.)
    – Jongware
    May 28, 2015 at 22:05
  • @Jongware -- the wonders that are possible with regular expressions and an hours free time are endless. All the Microsoft enums are neatly defined in rows of #define PREFIX_MEANING 0xVALUE and further delineated by filename. If automating some directory recursion and simple regex is too taxing for you, reverse engineering is probably not for you. Dec 31, 2020 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.