IDA is capable of loading multiple images/DLLs into the same database. In this scenario,
kernel.dll have been loaded additionally to the main target
.exe-file into the database. On top of that the PDB files
kernel.pdb have been loaded using
File -> Load file -> PDB file... with specifying the address of the respective image base.
It's working quite well, e. g. all the functions and symbols are visibly and usable. Nevertheless, some type information are missing. Most importantly: correct function declarations and argument types.
Here's what the decompiler gets me when using the approach described above for an example function
__int64 __fastcall ntdll_RtlUnwindEx(int a1, int a2, int a3, int a4, __int64 a5, __int64 a6);
However, this is how it looks like when analyzing
ntdll.dll in its own database and applying the PDB accordingly:
void __stdcall RtlUnwindEx(PVOID TargetFrame, PVOID TargetIp, PEXCEPTION_RECORD ExceptionRecord, PVOID ReturnValue, PCONTEXT ContextRecord, PUNWIND_HISTORY_TABLE HistoryTable);
Why is IDA not correctly determining the function declaration/argument types in the multi-image database even though the information should be there?
- Settings under
Options -> Compiler optionsin the multi-image database have been adjusted to match what the settings are for the single
- Working with 64-bit images here
Reanalyze programaction has been executed after loading all PDB files