In IDA, an enum (from “enumeration”) is a set of symbolic constants with numerical values. They can be thought of as a superset of C/C++ enum types and preprocessor defines.
These constants can be used in disassembly or pseudocode to replace specific numbers or their combinations with symbolic names, making the listing more readable and understandable.
Creating enums manually
The Enums view is a part of the default IDA desktop layout, but it can also be opened via View > Open subviews > Enumerations, or the shortcut Shift–F10.
To add a new enum, use “Add enum…” from the context menu, or the shortcut Ins (I on Macs).
In the dialog you can specify the name, width (size in bytes), and numerical radix for the symbolic constants.
Once the enum has been created, you can start adding constants to it. For this, use “Add enum member…” from the context menu, or the shortcut N.
An enum may have multiple constants with the same value but the names of all constants must be unique.
Creating enums via Local Types
Local Types view can also be used for creating enums. Simply press Ins, write a C syntax definition in the text box and click OK.
To make the enum available in the Enums view, so that it can be used in the disassembly, use “Synchronize to idb” from the context menu, or simply double-click the newly added enum type.
Importing enums from type libraries
Instead of creating an enum from scratch, you can also make use of type libraries shipped with IDA, which include enums from system headers and SDKs. If you know a name of the enum or one of its members, you can check if they’re present in the loaded type libraries. For this, use one of the two link buttons available in the “Add enum” dialog:
If you click one or the other, IDA will show you the list of all enums or members(symbols) available in the currently loaded type libraries.
If you know the standard enum name beforehand, simply enter it in the “Add enum” dialog and IDA will automatically import it if a match is found in a loaded type library.
Using enums
Enums can be used to replace (almost) any numerical value in the disassembly or pseudocode by a symbolic constant. This can be done from the context menu on a number:
Or by pressing the shortcut M, which shows a chooser:
The list of enum members is automatically narrowed down to those matching the number in the disassembly/pseudocode.
To see the value of the symbolic constant after conversion, hover the mouse over it:
See also: