5

I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: Download Center and placed it in IDA installation folder i.e. C:\program files\ida. I tried with both SDK and DDK but both failed. Here are the outputs:

  • SDK:
$>tilib64.exe -c -h"C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\um\Windows.h" abc.til
Error C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\um\Windows.h,1: Can't open include file 'winapifamily.h'
  • DDK:
$>tilib64.exe -c -h"C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\km\wdm.h" abc.til
Error C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\km\wdm.h,38: #error: Compiler version not supported by Windows DDK

Am I doing anything wrong? Should I add other header and lib files? What is the proper way to make a type libraries for Windows 10?

  • You can import Windows SDK/DDK headers into IDA View->Open subviews->Type Libraries, similar question reverseengineering.stackexchange.com/questions/13175/… – user22363 Jul 3 '18 at 1:49
  • The latest version of IDA viz 7.1 does have type libs for ucrt 16299. "FLIRT: vc/vc64: added signatures for ucrt 16299 (Windows 10 Fall Creators Update SDK)" – 0xec Jul 3 '18 at 5:49
  • A quote from readme.txt for tilib: "If your input file uses another header file (e.g. windows.h), you may opt to use the vc6win.til file instead of parsing it again. For that, just use the -b switch and specify vc6win.til as the base til. TILIB will load the contents of the specified file into the memory and parse the input file. All definitions from windows.h, including the preprocessor definitions, will be avaible: tilib -c -hinput_header_file -bbase_til_file output_til_file" Or just take the headers and remove anything that tilib complains about. – Anton Kukoba Jul 3 '18 at 7:30
  • For the DDK you could try loading ntoskrnl.exe with the pdb. That should give you many types, which you should then be able to export and use while reversing drivers. – mrexodia Jul 9 '18 at 10:37
4
  • Requirements: Here I used tilb64.exe from IDA SDK for making 64bit type library. IDA installation folder is E:\IDA70 and Windows SDK and DDK version 10.0.17134.0.

  • Options used: The following two batch files are: one for SDK and one for DDK. Copy the code in .bat or .cmd file. Edit the necessary paths for your IDA and SDK/DDK.

-c     create til-file
-h...  parse .h file
-D...  define a symbol
-I...  list of include directories
-e     ignore errors

Windows.h header file:

@echo off
cls
set ver=10.0.17134.0
set folder=%ProgramFiles(x86)%\Windows Kits\10\Include\%ver%
E:\IDA70\tilib64.exe -c ^
-Cc1 ^
-D_MSC_VER=1914 ^
-D_MSC_FULL_VER=191426433 ^
-D_WIN32_WINNT=0x0A00 ^
-DNTDDI_VERSION=WDK_NTDDI_VERSION ^
-DWDK_NTDDI_VERSION=NTDDI_WIN10_RS4 ^
-DNTDDI_WIN10_RS4=0x0A000005 ^
-D_WIN32 ^
-D_AMD64_ ^
-D_M_AMD64 ^
-D_inline=inline ^
-D__inline=inline ^
-D__forceinline=inline ^
-Dbool=uint8_t ^
-DSIZE_T=size_t ^
-DPSIZE_T=size_t* ^
-h"%folder%\um\Windows.h" ^
-I"%folder%\cppwinrt\winrt" ^
-I"%folder%\km" ^
-I"%folder%\km\crt" ^
-I"%folder%\shared" ^
-I"%folder%\ucrt" ^
-I"%folder%\um" ^
-I"%folder%\winrt" ^
-e ^
Windows_17134.til

ntddk.h header file:

@echo off
cls
set ver=10.0.17134.0
set folder=%ProgramFiles(x86)%\Windows Kits\10\Include\%ver%
E:\IDA70\tilib64.exe -c ^
-Cc1 ^
-D_MSC_VER=1914 ^
-D_MSC_FULL_VER=191426433 ^
-D_WIN32_WINNT=0x0A00 ^
-DNTDDI_VERSION=WDK_NTDDI_VERSION ^
-DWDK_NTDDI_VERSION=NTDDI_WIN10_RS4 ^
-DNTDDI_WIN10_RS4=0x0A000005 ^
-D_WIN32 ^
-D_AMD64_ ^
-D_M_AMD64 ^
-D_inline=inline ^
-D__inline=inline ^
-D__forceinline=inline ^
-D__volatile=volatile ^
-Dbool=uint8_t ^
-DRC_INVOKED ^
-D_INC_STRING ^
-h"%folder%\km\ntddk.h" ^
-I"%folder%\cppwinrt\winrt" ^
-I"%folder%\km" ^
-I"%folder%\km\crt" ^
-I"%folder%\shared" ^
-I"%folder%\ucrt" ^
-I"%folder%\um" ^
-I"%folder%\winrt" ^
-e ^
ntddk_17134.til
  • Notes: The include folder (with -I option) may change in future. The definitions (with -D option) are added by judging the conditional #define in corresponding header files. Add more definition until you satisfied. But there are many syntax errors in header files which are suppressed with -e option. Those can be remove only by editing every header files but that is more time consuming and tedious.
  • Also -Cc1 indicates that the compiler id is 1 (visual c++) -- from tilib -C?. – user202729 Sep 22 '18 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.