NB: most of my targets are PE files for pc
, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm
.
Let's say I load a PE file, which happens to be a 64-bit Windows driver. I may then see in the Output pane (redacted for brevity):
IDA is analysing the input file...
You may start to explore the input file right now.
...
Using FLIRT signature: Windows Driver Kit 7/10 64bit
Propagating type information...
Now "Windows Driver Kit 7/10 64bit" corresponds to $IDADIR/sig/pc/ms64wdk.sig
(found with dumpsig
). Fair enough. I also know that $IDADIR/sig/pc/autoload.cfg
governs what type information library (.til
) file gets loaded based on the loading of a signature.
Alas, there is no entry that maps the aforementioned $IDADIR/sig/pc/ms64wdk.sig
to ntddk64_win7
and ntapi64_win7
. Yet, when I use Produce file -> Dump database to IDC file... the resulting .idc
file has the following calls among its first actions (again redacted for brevity):
#define UNLOADED_FILE 1
#include <idc.idc>
static main(void) {
// ...
GenInfo(); // various settings
// ...
}
static GenInfo(void) {
// ...
add_default_til("ntddk64_win7");
add_default_til("ntapi64_win7");
}
Questions:
- How does IDA make the connection between the FLIRT (
.sig
) and the.til
here? (Apparently$IDADIR/sig/pc/autoload.cfg
has no bearing.) - Given there are also other
.til
files likentddk64_win10.til
,ntapi64_win10.til
:- How can I configure IDA to load those instead of the somehow implicit
ntddk64_win7
andntapi64_win7
respectively? - Assuming I can't override the behavior or have an existing IDB which had the implicit
ntddk64_win7
andntapi64_win7
applied: If I now useadd_default_til("ntddk64_win10")
andadd_default_til("ntapi64_win10")
(no matter whether IDC or IDAPython) will this adversely affect existing usage of type information (e.g. enums which were imported from standard enums)? How does it affect existing usage?
- How can I configure IDA to load those instead of the somehow implicit
- What is the relation between the
ntddk64.til
and, say,ntddk64_vista.til
,ntddk64_win7.til
,ntddk64_win8.til
,ntddk64_win81.til
andntddk64_win10.til
? Isntddk64.til
the superset? Some subset?
PS: Pointers to official documentation very much welcome.
ida.dll
andida64.dll
. So there's clearly more thanautoload.cfg
at work here.