Igor’s Tip of the Week #178: Field representation attributes – Hex Rays

Written by Igor Skochinsky | Mar 12, 2024

In the past, we’ve seen how structure instance representation can be changed by editing the structure in the Structures window. In IDA 8.4, a new unified view was introduced for Local Types and the same operations can (and should) be done in that window. Instead of comments, additional custom attributes are printed now:

In addition to the shortcuts (H, A and so on) and “Field type” submenu actions, you can also use the C syntax editor to add or edit these attributes:

Some may be obvious but what options are there? As of IDA 8.4, the following formatting attributes are supported:

  __bin         unsigned binary number
  __oct         unsigned octal number
  __hex         unsigned hexadecimal number
  __dec         signed decimal number
  __sbin        signed binary number
  __soct        signed octal number
  __shex        signed hexadecimal number
  __udec        unsigned decimal number
  __float       floating point
  __char        character
  __segm        segment name
  __enum()      enumeration member (symbolic constant)
  __off         offset expression (a simpler version of __offset)
  __offset()    offset expression
  __strlit()    string
  __stroff()    structure offset
  __custom()    custom data type and format
  __invsign     inverted sign
  __invbits     inverted bitwise
  __lzero       add leading zeroes
  __tabform()   tabular form (formatted array)

(see the link at the bottom of the post for details)

The new attributes offer possibilities that were not available before; for example, signed fields were not supported explicitly but either always positive or always negated values.