Type System Keywords

Attributes

Below is the full list of attributes that can be handled by IDA:

• packed: pack structure/union fields tightly, without gaps

• aligned: specify the alignment

• noreturn: declare as not returning function

• ms_struct: use microsoft layout for the structure/union

• format: possible formats: printf, scanf, strftime, strfmon

Number representation keywords

For data declarations, the following custom __attribute((annotate(X))) keywords have been added. They control the representation of numbers in the output:

__bin unsigned binary number

__oct unsigned octal number

__hex unsigned hexadecimal number

__dec signed decimal number

__sbin signed binary number

__soct signed octal number

__shex signed hexadecimal number

__udec unsigned decimal number

__float floating point

__char character

__segm segment name

__enum() enumeration member (symbolic constant)

__off offset expression (a simpler version of __offset)

__offset() offset expression

__strlit() string __stroff() structure offset

__custom() custom data type and format

__invsign inverted sign

__invbits inverted bitwise

__lzero add leading zeroes

__tabform() tabular form

Explicit-size types

_BOOL1 a boolean type with explicit size specification (1 byte)

_BOOL2 a boolean type with explicit size specification (2 bytes)

_BOOL4 a boolean type with explicit size specification (4 bytes)

__int8 an integer with explicit size specification (1 byte)

__int16 an integer with explicit size specification (2 bytes)

__int32 an integer with explicit size specification (4 bytes)

__int64 an integer with explicit size specification (8 bytes)

__int128 an integer with explicit size specification (16 bytes)

_BYTE an unknown type; the only known info is its size: 1 byte

_WORD an unknown type; the only known info is its size: 2 bytes

_DWORD an unknown type; the only known info is its size: 4 bytes

_QWORD an unknown type; the only known info is its size: 8 bytes

_OWORD an unknown type; the only known info is its size: 16 bytes

_TBYTE 10-byte floating point value

_UNKNOWN no info is available

Function and argument keywords

__pure pure function: always returns the same value and does not modify memory in a visible way

__noreturn function does not return

__usercall user-defined calling convention; see above

__userpurge user-defined calling convention; see above

__golang golang calling convention

__swiftcall swift calling convention

__spoils explicit spoiled-reg specification; see above

__hidden hidden function argument; this argument was hidden in the source code (e.g. 'this' argument in c++ methods is hidden)

__return_ptr pointer to return value; implies hidden

__struct_ptr was initially a structure value

__array_ptr was initially an array

__unused unused function argument

__high high level prototype (does not explicitly specify hidden arguments like 'this', for example) this keyword may not be specified by the user but IDA may use it to describe high level prototypes

Pointer keywords

__ptr32 explicit pointer size specification (32 bits)

__ptr64 explicit pointer size specification (64 bits)

__shifted shifted pointer declaration

Struct and enum keywords

__cppobj a c++ style struct; the struct layout depends on this keyword

__bitmask a bitmask enum, a collection of bit groups

__tuple a tuple, a special kind of struct. tuples behave like structs but have more relaxed comparison rules: the field names and alignments are ignored.

__invbf a structure that allocates its bitfield members from the end of their storage unit opposite to the one the byte order of the database implies

Bitfield allocation order

A compiler allocates the members of a bitfield from one end of their storage unit or the other, independently of the byte order. A structure follows the byte order of the database unless it says otherwise: least significant bit first on a little-endian database, most significant bit first on a big-endian one. The Microsoft PowerPC compilers, for example, allocate from the most significant bit.

A structure that uses the other end carries the __invbf attribute, which is written in the same place as __cppobj:

struct __invbf IMAGE_RESOURCE_DIRECTORY_ENTRY
{
  unsigned int NameOffset : 31;
  unsigned int NameIsString : 1;
};

The same can be expressed with a directive, which both type parsers accept:

#pragma bitfield_order(lsb_to_msb | msb_to_lsb | default | push | pop)
#pragma bitfield_order(push, lsb_to_msb | msb_to_lsb | default)

It applies to the declarations that follow it, and push/pop nest it. A structure declared under an order that differs from the database default comes out with __invbf set. There is no database-wide setting; the attribute on the type is the whole model.

The order matters to the decompiler, which uses it to map a member to the bits it occupies: see Bitfield member accesses.