We’ve seen how custom structures can be used to format data tables nicely, but sometimes you can improve your understanding even further with small adjustments. For example, in the structure we created, the first member (nMessage) is printed as a simple integer:
If you know Win32 API well, you may recognize that these numbers correspond to window messages, but it would be nice to see the symbolic names instead of numbers without having to check MSDN or Windows headers every time. In fact, IDA already has this mapping in the standard type libraries, so we just need to use it for our structure member. It can be done pretty easily using the following steps:
- Open the Enums window (Shift+F10).
- Press Ins or use “Add Enum…” from the context menu.
- Either click Add standard enum by symbol name and pick one of the known messages (e.g.
WM_COMMAND), or just typeMACRO_WMin the Name field directly, then click OK.
- now go to
AFX_MSGMAP_ENTRYin the Structures window - on the first field, use Field type > Enum member… from the context menu, or the shortcut M.
- select
MACRO_WMfrom the list. An automatic comment is added for the field:
- back in the listing, the numbers are replaced by the symbolic constants:
See also:
Igor’s tip of the week #99: Enums
Igor’s Tip of the Week #125: Structure field representation
Igor’s tip of the week #60: Type libraries
