Igor’s Tip of the Week #179: Bitmask enums

Malware Analysis
1

We’ve covered simple enums previously, but there is a different kind of enums that you may sometimes encounter or need to create manually. They are used to represent various bits (or flags) which may be set in an integer value. For example, the file mode on Unix filesystems contains Access Permission bits (you can see them in the output of ls as string like -rwxr-xr-x), and each bit has a corresponding constant:

#define S_IRWXU 00700
#define S_IRUSR 00400
#define S_IWUSR 00200
#define S_IXUSR 00100

#define S_IRWXG 00070

#define S_IRGRP 00040

#define S_IWGRP 00020

#define S_IXGRP 00010


#define S_IRWXO 00007

#define S_IROTH 00004

#define S_IWOTH 00002

#define S_IXOTH 00001


Whenever you have a value which can be represented as a combination of bit values, you can use bitmask enums (used to be called bitfields before 8.4 but renamed to reduce confusion with bitfields in structures).

To create a bitmask enum, check “Bitmask” on the Enum tab in the “Add type” dialog:




The new enum gets the IDA-specific __bitmask arttribute: FFFFFFFF enum __bitmask __oct FILE_PERMS // 4 bytes

FFFFFFFF {

FFFFFFFF };

Article Link: Igor’s Tip of the Week #179: Bitmask enums – Hex Rays