Igor’s Tip of the Week #179: Bitmask enums

We’ve covered simple enums previously, but there is a different kind of enum that you may sometimes encounter or need to create manually. They are used to represent various bits (or flags) which may be set in an integer value. For example, the file mode on Unix filesystems contains Access Permission bits (you can […]

Igor’s Tip of the Week #177: Unused argument attribute

In one of the past tips we mentioned the __unused attribute which can be applied to function arguments. When can it be useful?  Let’s consider this code from Apple’s dyld: v19 is passed as fist argument to dyld4::ProcessConfig::PathOverrides::setString(). Since its name looks like a class method, the decompiler assigned the class type to the first argument […]

Igor’s Tip of the Week #175: IDB work directory

As we’ve seen previously, an IDB (IDA database) consists of several embedded files which contain the actual database data and which IDA reads/write directly when working with the database. By default, they’re unpacked next to the IDB, which can lead to various issues such as excessive disk usage, or speed (e.g. if IDB is […]

Igor’s Tip of the Week #174: IDA database (IDB) details

When you work in IDA, it saves the results of your analysis in the IDA Database, so that you can pause and continue at a later time. You can recognize the database files by their file extension .idb (for legacy, 32-bit IDA) or .i64 (for 64-bit IDA or IDA64). Thus they’re also often called just […]

Igor’s Tip of the Week #171: Enums as structure members

We’ve seen how custom structures can be used to format data tables nicely, but sometimes you can improve your understanding even further with small adjustments. For example, in the structure we created, the first member (nMessage) is printed as a simple integer: If you know Win32 API well, you may recognize that these numbers correspond […]