TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc
).
In order to explicitly load a type library I can use add_default_til()
(formerly LoadTil()
). However, there doesn't appear to be any counterpart to this function to unload a previously loaded type library. And that's what I am looking for.
My issue is that although %ProgramFiles%\IDA Pro 7.7\sig\pc\autoload.cfg
does not list the ntddk64_win7
and ntapi64_win7
type libraries, they seem to get loaded implicitly somehow. Chances are (but I haven't found documentation to corroborate this; the only connection seems to be autoload.cfg
) that this has to do with the following log lines:
Using FLIRT signature: Windows Driver Kit 7/10 64bit
Using FLIRT signature: Windows Driver Kit 7/10 64bit
Propagating type information...
Function argument information has been propagated
The initial autoanalysis has been finished.
Now, I'd like to unload those two and instead load ntddk64_win10
and ntapi64_win10
respectively (possibly re-running auto-analysis).
Alas, I haven't found a way to script this.
Bonus question: is there something that ties the FLIRT signatures to type libraries (.til
) aside from autoload.cfg
?