Types

Working with Types: A Beginner's Guide

IDA type system fundamentals

The IDA type system is based on C-like constructs such as:

• Structures: Aggregate data types that group multiple members.

• Unions: Allow overlapping the same memory with different data types.

• Enums: Provide named integer constants.

IDA ships with type libraries out-of-the-box, but you can define custom types in the Local Types window.

Type definitions sources

• Built-in or custom type libraries(.til files)

• Custom types

• Debug information (e.g., PDB or DWARF)

Type libraries

IDA ships with type libraries for popular platforms and operating systems. They provide predefined data types that can be used in your analysis. You can view a list of currently loaded type libraries in the Type Libraries window (View -> Open subviews -> Type Libraries, or Shift+F11)

Load additional type libraries

1. Go to the Type Libraries window. Right-click on the libraries list and select Load type library..., or press the Ins key.

Load type library

1. Select the type library from the list and click OK.

Once loaded, type library definitions are accessible throughout IDA, including the Local Types window.

Relation between Local Types and Type Libraries: In IDA, Local Types are custom or imported type definitions specific to your current project, while Type Libraries provide pre-defined types for common platforms and architectures. Types in the Type Libraries, once referenced, are copied into the IDB and appear under the Local Types window.

See also:

• Check TILIB tutorial for creating custom type libraries

Type management essentials: Local Types view

The Local Types view provides a centralized hub for managing and customizing type definitions directly within the IDA UI. To access this view, navigate to View -> Open subviews -> Local Types or press Shift+F1 keys.

Local Types window

In the Local Types window, you can:

• Add a single type (structure, union, and enumeration), including importing types from loaded type libraries
• Create multiple types at once by parsing declarations
• Modify existing types
• Delete existing types
• Copy full type(s) definition to clipboard

Add new types

In the Add type dialog, you can create a custom structure, union, and enumeration, or import them from loaded libraries. To add a new type:

• press the Ins key or

• right-click on the types list and select Add type... from the context menu.

Create a structure (struct)

1. Open the Add type dialog and in the Struct tab configure the structure settings:

Understanding structure options:

• Name: the unique name of your struct.

• Fixed layout (default: enabled) When checked:

  • It locks the struct size and members. It prevents accidentally changing the struct size, for example, if the user moves members around while modifying another type.

  • You need to specify the Structure size in bytes.

• Make type choosable (default: enabled) When checked:

  • It includes this struct in the type listing.

• Pack fields (default: disabled) When checked:

  • It packs the fields of the struct (removes padding) and saves memory.

• Create union (Leave unchecked for structures)

  • Only check it when creating a union instead of a struct.

1. Click OK.

As an alternative, you can create or edit structures via free-text editor.

Create a union

A union is de facto a type of a struct. Creating and editing unions follow the same principles as working with structs.

1. Open the Add type dialog and in the Struct tab configure the union settings:

   • specify the unique name of your union, and

   • check the Create union checkbox.

When you choose to create a union, the fixed layout option will no longer be available. If you would like to turn a union to a fixed layout structure, first change "union" to "struct" in the C syntax tab, and then edit the struct.

1. Click OK.

Create an enumeration (enum)

1. Open the Add type dialog and in the Enum tab configure the enum settings:

Understanding enum options:

• Name: specify the unique name of your enum

• Size: (default: auto)

  • It determines how much memory the enum values will occupy

  • You can select from dropdown the number of bytes (1, 2, 4, or 8 bytes)

  • The auto option lets the compiler decide based on values

• Number representation: defines how enum values are displayed in IDA

  • Select the format for enum members from the available options: Hexadecimal, Decimal, Octal, Binary or Character (ASCII/Unicode)

• Signed: (default: disabled)

  • It determines if enum values can be negative

• Bitmask: (default: disabled) When checked:

  • It makes the enum a bitfield, and allows the representation of multiple flags in a single value using bitwise operations (e.g., OR, AND)

1. Click OK.

As an alternative, you can create or edit enums via free-text editor.

Modify existing types

To modify an existing type:

• press Ctrl+E or

• right-click on the list of existing types and select Edit type... from the context menu.

Delete existing types

To delete an existing type:

• press Del or

• right-click on the list of existing types and select Delete type... from the context menu.

Copy full type(s) definition to clipboard

To copy the entire C-style definition of the type:

1. In the Local Types view, right-click on the type you want to copy and select Copy full type(s) from the context menu

2. The complete definition, including all nested types and dependencies, will be copied to your clipboard.

Adding/editing types via free-text editor

The Struct/Enum tabs are perfect for learning IDA type system and creating simple, single types. However, for more complex tasks—such as copying types from existing source code or defining multiple related types simultaneously—the text editor offers greater efficiency and flexibility.

Add a type using C syntax tab

1. In the Local Types view, open the Add type dialog.

2. Go to the C syntax tab and enter a new type declaration.

Edit a type using C syntax tab

1. In the Local Types view, right-click on the existing type and select Edit type... from the context menu.

2. Go to the C syntax tab and modify the type.

Create multiple type definitions at once

The Parse declarations... option allows you to input and process many type definitions at once, enabling batch creation of multiple types.

1. Right-click on the types list in the Local Types view and select Parse declarations... from the context menu.

2. In the Parse declarations... dialog, enter the type definitions using C syntax and click OK to add them to the Local Types.

Importing types

Import types from loaded type libraries

Before you start importing types from type libraries, ensure that your desired library is already loaded in the Type Libraries window.

Import standard structures

If you want to import an existing standard structure:

1. Open the Add type dialog and in the Struct tab, click Import standard structure.

   
2. In the new dialog, browse and select the structure from the list of all corresponding types in the loaded libraries, then click OK to import it.

Import standard enums

If you want to import an existing standard enum from the type library:

1. Open the Add type dialog and in the Enum tab, click:

• Import standard enum by enum name (1), or

• Import standard enum by symbol name (2) (useful when you know member names but not the enum name).

1. In the new dialog, browse and select the enum from the list of all corresponding types in the loaded libraries, then click OK to import it.

Import types definitions from C/C++ header files

Header files can be parsed by two different parsers:

• a default parser, shipped out-of-the-box with IDA, that supports basic C, or

• IDACLang, which deals with complex C/C++/Objective-C source code.

You can select source parser in Options → Compiler...:

To import type definitions from header files:

1. Navigate to Files -> Load file -> Parse C header file...

2. Select your header file and click OK to import it. You should see a notification about a successful compilation. When you import a header file, all the type definitions from that file are added to your Local Types.

How can I download IDACLang? IDAClang is a standalone command line tool to produce type libraries, that you can get from My Hex-Rays download center.

See also:

• IDAClang tutorial

Import debug information

IDA supports debugging information formats such as PDB and DWARF. If your input file includes debugging information with types data, IDA will automatically import the types while loading the file.

The imported types will be displayed in the Local Types window, organized under the corresponding folder (either dwarf or pdb).

Types imported with debug info

Working with types programmatically

In addition to the manual approach through IDA's graphical interface, types can be created, modified, and managed programmatically using our APIs. This, among others, allows for the automation of type-related tasks or the creation of complex data structures, making it particularly useful for handling large sets of types or performing repetitive operations.

What next:

• Check IDAPython examples dedicated to working with types