0

TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).

Unloading type library from the GUI


In order to explicitly load a type library I can use add_default_til() (formerly LoadTil()). However, there doesn't appear to be any counterpart to this function to unload a previously loaded type library. And that's what I am looking for.

My issue is that although %ProgramFiles%\IDA Pro 7.7\sig\pc\autoload.cfg does not list the ntddk64_win7 and ntapi64_win7 type libraries, they seem to get loaded implicitly somehow. Chances are (but I haven't found documentation to corroborate this; the only connection seems to be autoload.cfg) that this has to do with the following log lines:

Using FLIRT signature: Windows Driver Kit 7/10 64bit
Using FLIRT signature: Windows Driver Kit 7/10 64bit
Propagating type information...
Function argument information has been propagated
The initial autoanalysis has been finished.

Now, I'd like to unload those two and instead load ntddk64_win10 and ntapi64_win10 respectively (possibly re-running auto-analysis).

Alas, I haven't found a way to script this.

Bonus question: is there something that ties the FLIRT signatures to type libraries (.til) aside from autoload.cfg?

1 Answer 1

1

To unload a type library you can use del_til function from typeinf.hpp.

Usage with IDAPython:

import ida_typeinf

ida_typeinf.add_til("ntapi64_win7", ida_typeinf.ADDTIL_DEFAULT) # load a til file
ida_typeinf.del_til("ntapi64_win7") # unload a til file
3
  • Guess I won't get around using IDAPython after all 😁 ... thanks and welcome to RE.SE.
    – 0xC0000022L
    Apr 21 at 21:06
  • Thanks. I don't know why you are using IDC in this case, but I want to remind you that there is an exec_python function in idc.idc, maybe that will help :)
    – y_v
    Apr 22 at 0:07
  • 1
    so something like exec_python("import ida_typeinf;ida_typeinf.del_til('ntapi64_win7');ida_typeinf.add_til('ntapi64_win10', ida_typeinf.ADDTIL_DEFAULT)") would work (but it looks terrible)
    – y_v
    Apr 22 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.