IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top of that the PDB files ntdll.pdb and kernel.pdb have been loaded using File -> Load file -> PDB file... with specifying the address of the respective image base.

It's working quite well, e. g. all the functions and symbols are visibly and usable. Nevertheless, some type information are missing. Most importantly: correct function declarations and argument types.

Here's what the decompiler gets me when using the approach described above for an example function RtlUnwindEx:

__int64 __fastcall ntdll_RtlUnwindEx(int a1, int a2, int a3, int a4, __int64 a5, __int64 a6);

However, this is how it looks like when analyzing ntdll.dll in its own database and applying the PDB accordingly:

void __stdcall RtlUnwindEx(PVOID TargetFrame, PVOID TargetIp, PEXCEPTION_RECORD ExceptionRecord, PVOID ReturnValue, PCONTEXT ContextRecord, PUNWIND_HISTORY_TABLE HistoryTable);

Why is IDA not correctly determining the function declaration/argument types in the multi-image database even though the information should be there?

Additional information:

  • Settings under Options -> Compiler options in the multi-image database have been adjusted to match what the settings are for the single ntdll.dll database
  • Working with 64-bit images here
  • The Reanalyze program action has been executed after loading all PDB files
  • both look suspect if it is 64bit __stdcall is not applicable are you sure you are not mixing up a 32 bit ntdll with a 64 bit ntdll or something like that
    – blabb
    Mar 11 '21 at 7:34
  • Yeah, also saw that and was wondering as well but no, I'm loading the same file, both times as AMD64 PE file.
    – new_turtle
    Mar 11 '21 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.