YAML enumeration field type objects

Enumeration field type objects are the types of enumeration data fields, found in data streams.

An enumeration data field is an integer data field.

An enumeration field type is an integer field type with mappings. An enumeration field type mapping is a labeled set of integer ranges. An enumeration data field can have zero or more labels depending on its value.

Properties

Name Type Description Req? Default

class

String

This property’s value must be one of:

unsigned-enumeration
unsigned-enum
uenum

Unsigned enumeration field type

signed-enumeration
signed-enum
senum

Signed enumeration field type

Yes if the $inherit property is not set.

$inherit

String

Name of a field type alias from which to inherit.

Yes if the class property is not set.

size

Positive integer

Size of this field type’s instances (bits).

This property’s value must be in the [1, 64] range.

Yes

alignment

Power-of-two integer

Alignment of the first bit of this field type’s instances within a CTF packet (bits).

No

8 if the size property is a multiple of 8, or 1 otherwise.

preferred-display-base

String

The preferred base (radix) to use when displaying this field type’s instances.

The value of this property is only a hint to CTF consumers; they don’t have to consider it.

This property’s value must be one of:

bin
binary

Binary.

oct
octal

Octal.

dec
decimal

Decimal.

hex
hexadecimal

Hexadecimal.

No

Decimal preferred display base

mappings

Mapping of string keys to enumeration field type mapping sequences

Mappings of this enumeration field type.

Each mapping assigns a label to a set of integer ranges.

This mapping must contain at least one entry.

Yes

Enumeration field type mapping sequence

A YAML sequence of integer ranges, which can be:

A sequence of two integers

The first integer is the range’s lower value (included).

The second integer is the range’s upper value (included).

An integer

This is equivalent to a sequence of two identical integers.

In other words, 17 is equivalent to [17, 17].

This sequence must contain at least one item.

Generated C types

Depending on the signedness of the integer field type and on the value of its size property:

Signedness / Size (bits) [1, 8] [9, 16] [17, 32] [33, 64]

Unsigned

uint8_t

uint16_t

uint32_t

uint64_t

Signed

int8_t

int16_t

int32_t

int64_t

Examples

Example 1. Basic 8-bit unsigned enumeration field type object with a single mapping
class: unsigned-enumeration
size: 8
mappings:
  A: [0]
Example 2. 23-bit signed enumeration field type object with simple mappings.
class: signed-enumeration
size: 23
mappings:
  A: [2]
  B: [5]
  C: [9]
Example 3. 32-bit-aligned 16-bit signed enumeration field type object with mappings.
class: signed-enumeration
size: 16
alignment: 32
mappings:
  RUNNING:
    - 17
    - [19, 24]
    - -144
  WAITING:
    - 18
    - [-32, -25]
  STOPPED: [202]
Example 4. 32-bit unsigned enumeration field type object with a hexadecimal preferred display base and mappings.
class: unsigned-enumeration
size: 32
preferred-display-base: hexadecimal
mappings:
  steam-machine: [18]
  on/off:
    - 15
    - [200, 1000]
  the-prime-time-of-your-life: [2]