IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll
and kernel.dll
have been loaded additionally to the main target .exe
-file into the database. On top of that the PDB files ntdll.pdb
and kernel.pdb
have been loaded using File -> Load file -> PDB file...
with specifying the address of the respective image base.
It's working quite well, e. g. all the functions and symbols are visibly and usable. Nevertheless, some type information are missing. Most importantly: correct function declarations and argument types.
Here's what the decompiler gets me when using the approach described above for an example function RtlUnwindEx
:
__int64 __fastcall ntdll_RtlUnwindEx(int a1, int a2, int a3, int a4, __int64 a5, __int64 a6);
However, this is how it looks like when analyzing ntdll.dll
in its own database and applying the PDB accordingly:
void __stdcall RtlUnwindEx(PVOID TargetFrame, PVOID TargetIp, PEXCEPTION_RECORD ExceptionRecord, PVOID ReturnValue, PCONTEXT ContextRecord, PUNWIND_HISTORY_TABLE HistoryTable);
Why is IDA not correctly determining the function declaration/argument types in the multi-image database even though the information should be there?
Additional information:
- Settings under
Options -> Compiler options
in the multi-image database have been adjusted to match what the settings are for the singlentdll.dll
database - Working with 64-bit images here
- The
Reanalyze program
action has been executed after loading all PDB files