Type System Keywords

Below is the full list of attributes that can be handled by IDA:

• packed: pack structure/union fields tightly, without gaps

• aligned: specify the alignment

• noreturn: declare as not returning function

• ms_struct: use microsoft layout for the structure/union

• format: possible formats: printf, scanf, strftime, strfmon

For data declarations, the following custom __attribute((annotate(X))) keywords have been added. The control the representation of numbers in the output:

Keyword	Description
__bin	unsigned binary number
__oct	unsigned octal number
__hex	unsigned hexadecimal number
__dec	signed decimal number
__sbin	signed binary number
__soct	signed octal number
__shex	signed hexadecimal number
__udec	unsigned decimal number
__float	floating point
__char	character
__segm	segment name
__enum()	enumeration member (symbolic constant)
__off	offset expression (a simpler version of __offset)
__offset()	offset expression
__strlit()	string __stroff() structure offset
__custom()	custom data type and format
__invsign	inverted sign
__invbits	inverted bitwise
__lzero	add leading zeroes
__tabform()	tabular form
__fixed(size)	declares a struct with an explicit total size
__at(offset)	specifies the exact byte offset for a field
__at(offset, bit)	specifies offset with bit-level precision for bitfields

The following additional keywords can be used in type declarations:

Keyword	Description
_BOOL1	a boolean type with explicit size specification (1 byte)
_BOOL2	a boolean type with explicit size specification (2 bytes)
_BOOL4	a boolean type with explicit size specification (4 bytes)
__int8	a integer with explicit size specification (1 byte)
__int16	a integer with explicit size specification (2 bytes)
__int32	a integer with explicit size specification (4 bytes)
__int64	a integer with explicit size specification (8 bytes)
__int128	a integer with explicit size specification (16 bytes)
_BYTE	an unknown type; the only known info is its size: 1 byte
_WORD	an unknown type; the only known info is its size: 2 bytes
_DWORD	an unknown type; the only known info is its size: 4 bytes
_QWORD	an unknown type; the only known info is its size: 8 bytes
_OWORD	an unknown type; the only known info is its size: 16 bytes
_TBYTE	10-byte floating point value
_UNKNOWN	no info is available
__pure	pure function: always returns the same value and does not modify memory in a visible way
__noreturn	function does not return
__usercall	user-defined calling convention; see above
__userpurge	user-defined calling convention; see above
__golang	golang calling convention
__swiftcall	swift calling convention
__spoils	explicit spoiled-reg specification; see above
__hidden	hidden function argument; this argument was hidden in the source code (e.g. 'this' argument in c++ methods is hidden)
__return_ptr	pointer to return value; implies hidden
__struct_ptr	was initially a structure value
__array_ptr	was initially an array
__unused	unused function argument __cppobj a c++ style struct; the struct layout depends on this keyword
__ptr32	explicit pointer size specification (32 bits)
__ptr64	explicit pointer size specification (64 bits)
__shifted	shifted pointer declaration
__high	high level prototype (does not explicitly specify hidden arguments like 'this', for example) this keyword may not be specified by the user, but IDA may use it to describe high level prototypes
__bitmask	a bitmask enum, a collection of bit groups
__tuple	a tuple, a special kind of struct. Tuples behave like structs but have more relaxed comparison rules: the field names and alignments are ignored.