## Keyboard shortcuts

Press `←` or `→` to navigate between chapters

Press `S` or `/` to search in the book

Press `?` to show this help

Press `Esc` to hide this help

# Bitfields

There is a special kind of enums: bitfields. A bitfield is an enum divided into bit groups. When you define a new symbolic constant in a bitfield, you need to specify the group to which the constant will belong to. By default, IDA proposes groups containing one bit each. If a group is not defined yet, it is automatically created when the first constant in the group is defined. For example:

            name    CONST1
            value   0x1
            mask    0x1

will define a constant named CONST1 with value 1 and will create a group containing only one bit. Another example. Let’s consider the following definitions:

     #define OOF_SIGNMASK    0x0003
     #define   OOFS_IFSIGN   0x0000
     #define   OOFS_NOSIGN   0x0001
     #define   OOFS_NEEDSIGN 0x0002
     #define OOF_SIGNED      0x0004
     #define OOF_NUMBER      0x0008
     #define OOF_WIDTHMASK   0x0030
     #define   OOFW_IMM      0x0000
     #define   OOFW_16       0x0010
     #define   OOFW_32       0x0020
     #define   OOFW_8        0x0030
     #define OOF_ADDR        0x0040
     #define OOF_OUTER       0x0080
     #define OOF_ZSTROFF     0x0100

How do we describe this?

       name           value    mask   maskname

       OOFS_IFSIGN   0x0000   0x0003 OOF_SIGNMASK
       OOFS_NOSIGN   0x0001   0x0003 OOF_SIGNMASK
       OOFS_NEEDSIGN 0x0002   0x0003 OOF_SIGNMASK
     OOF_SIGNED      0x0004   0x0004
     OOF_NUMBER      0x0008   0x0008
       OOFW_IMM      0x0000   0x0030 OOF_WIDTHMASK
       OOFW_16       0x0010   0x0030 OOF_WIDTHMASK
       OOFW_32       0x0020   0x0030 OOF_WIDTHMASK
       OOFW_8        0x0030   0x0030 OOF_WIDTHMASK
     OOF_ADDR        0x0040   0x0040
     OOF_OUTER       0x0080   0x0080
     OOF_ZSTROFF     0x0100   0x0100

If a mask consists of more than one bit, it can have a name and a comment. A mask name can be set when a constant with the mask is being defined. IDA will display the mask names in a different color.

In order to use a bitfield in the program, just convert an instruction operand to enum. IDA will display the operand like this:

            mov     ax, 70h

will be replaced by

            mov     ax, OOFS_IFSIGN or OOFW_8 or OOF_ADDR