2

I use IDA Pro 6.8.150428 (idaq64.exe) to disassemble system dlls (64 bit) e.g. ntdll.dll, kernel32.dll, etc. in Windows 10 64 bit. I found idaq64.exe correctly disassembling 64 bit sample applications (.exe) but generating incorrect dis-assembly for the dlls e.g. shows 32 bit register operands, etc. I checked the IDA Pro dis-assembly output with WinDbg (runtime) and Intel XED (static) output. While Windbg and XED outputs are consistent with each other, they are completely different than that of IDA Pro.

Runtime disassembly in WinDbg @00007ffda61c12e0

00007ffda61c12db      call    ntdll!NtQueryPerformanceCounter (00007ffda6213b30)
00007ffda61c12e0      mov     eax,dword ptr [rsp+30h]
00007ffda61c12e4      mov     rsi,qword ptr [rsp+40h]
00007ffda61c12e9      shl     rax,20h
00007ffda61c12ed      xor     rax,qword ptr [rsp+30h]
00007ffda61c12f2      xor     rax,rbx
00007ffda61c12f5      mov     rbx,qword ptr [rsp+38h]
00007ffda61c12fa      xor     rax,rdi
00007ffda61c12fd      add     rsp,20h
00007ffda61c1301      pop     rdi
00007ffda61c1302      ret

The static address in the ntdll.dll binary corresponding to the runtime address mentioned above (7ffda61c12e0) is 4b2c12e0. I even don't see the address in ntdll.dll dis-assembly in IDA Pro. It shows:

.text:4B2C12DF                 test    eax, eax
.text:4B2C12E1                 js      loc_4B30C906
.text:4B2C12E7                 mov     [esp+278h+var_255], 1
.text:4B2C12EC
.text:4B2C12EC loc_4B2C12EC:                           ; CODE XREF: LdrpPreprocessDllName(x,x,x,x)+4B66Bj
.text:4B2C12EC                 mov     ecx, [esp+278h+var_254]
.text:4B2C12F0                 xor     ebx, ebx
.text:4B2C12F2                 xor     dl, dl
.text:4B2C12F4                 mov     [esp+278h+var_264], ebx
.text:4B2C12F8                 mov     [esp+278h+var_25D], dl
.text:4B2C12FC                 test    byte ptr [ecx], 8
.text:4B2C12FF                 jnz     loc_4B2C160B
.text:4B2C1305                 mov     edi, [esp+278h+var_25C]
.text:4B2C1309                 xor     al, al
.text:4B2C130B                 mov     ecx, large fs:30h
 .text:4B2C1312                 mov     [esp+278h+var_244], edi

Apparently, IDA Pro is disassembling the dll incorrectly. How can I make IDA Pro correctly disassemble 64 bit dlls?

  • what is that translation ? why not try searching for the function ntquery and looking at the xrefs to it instead of translating whatever to whatsoever – blabb Mar 9 '16 at 21:36
  • Sorry, if my question is not clear again :(. The concern is IDA Pro 64 bit is disassembling 64 bit ntdll.dll (and other dlls) incorrectly. It is showing all 32 bit registers, while WinDbg shows 64 bit registers. If I can make IDA Pro working correctly for 64 bit dlls, that would help a lot. – ssultana Mar 10 '16 at 1:18
  • 1
    Are you loading them into IDA directly from system32? – tmr232 Mar 10 '16 at 6:48
2

On 64-bit Windows, any 32-bit process trying to access C:\Windows\system32 is transparently redirected to C:\Windows\SysWOW64.

Since IDA (Both idaq.exe and idaq64.exe) are 32-bit processes, you are actually opening C:\Windows\SysWOW64\ntdll.dll (which is a 32-bit file) instead of C:\Windows\system32\ntdll.dll.

To open the correct file, copy it from C:\Windows\system32 to a different directory, and open it from there.

  • Thanks, it was a life-saver. Yes, I was loading the dlls into IDA from system32 folder. – ssultana Mar 10 '16 at 8:19
  • Can you please accept the answer so that other people will know the question is answered? – tmr232 Mar 10 '16 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.