IDA Pro 64 bit disassembly error for system DLLs

Question

I use IDA Pro 6.8.150428 (idaq64.exe) to disassemble system dlls (64 bit) e.g. ntdll.dll, kernel32.dll, etc. in Windows 10 64 bit. I found idaq64.exe correctly disassembling 64 bit sample applications (.exe) but generating incorrect dis-assembly for the dlls e.g. shows 32 bit register operands, etc. I checked the IDA Pro dis-assembly output with WinDbg (runtime) and Intel XED (static) output. While Windbg and XED outputs are consistent with each other, they are completely different than that of IDA Pro.

Runtime disassembly in WinDbg @00007ffda61c12e0

00007ffda61c12db      call    ntdll!NtQueryPerformanceCounter (00007ffda6213b30)
00007ffda61c12e0      mov     eax,dword ptr [rsp+30h]
00007ffda61c12e4      mov     rsi,qword ptr [rsp+40h]
00007ffda61c12e9      shl     rax,20h
00007ffda61c12ed      xor     rax,qword ptr [rsp+30h]
00007ffda61c12f2      xor     rax,rbx
00007ffda61c12f5      mov     rbx,qword ptr [rsp+38h]
00007ffda61c12fa      xor     rax,rdi
00007ffda61c12fd      add     rsp,20h
00007ffda61c1301      pop     rdi
00007ffda61c1302      ret

The static address in the ntdll.dll binary corresponding to the runtime address mentioned above (7ffda61c12e0) is 4b2c12e0. I even don't see the address in ntdll.dll dis-assembly in IDA Pro. It shows:

.text:4B2C12DF                 test    eax, eax
.text:4B2C12E1                 js      loc_4B30C906
.text:4B2C12E7                 mov     [esp+278h+var_255], 1
.text:4B2C12EC
.text:4B2C12EC loc_4B2C12EC:                           ; CODE XREF: LdrpPreprocessDllName(x,x,x,x)+4B66Bj
.text:4B2C12EC                 mov     ecx, [esp+278h+var_254]
.text:4B2C12F0                 xor     ebx, ebx
.text:4B2C12F2                 xor     dl, dl
.text:4B2C12F4                 mov     [esp+278h+var_264], ebx
.text:4B2C12F8                 mov     [esp+278h+var_25D], dl
.text:4B2C12FC                 test    byte ptr [ecx], 8
.text:4B2C12FF                 jnz     loc_4B2C160B
.text:4B2C1305                 mov     edi, [esp+278h+var_25C]
.text:4B2C1309                 xor     al, al
.text:4B2C130B                 mov     ecx, large fs:30h
 .text:4B2C1312                 mov     [esp+278h+var_244], edi

Apparently, IDA Pro is disassembling the dll incorrectly. How can I make IDA Pro correctly disassemble 64 bit dlls?

Answer 1

On 64-bit Windows, any 32-bit process trying to access C:\Windows\system32 is transparently redirected to C:\Windows\SysWOW64.

Since IDA (Both idaq.exe and idaq64.exe) are 32-bit processes, you are actually opening C:\Windows\SysWOW64\ntdll.dll (which is a 32-bit file) instead of C:\Windows\system32\ntdll.dll.

To open the correct file, copy it from C:\Windows\system32 to a different directory, and open it from there.