2

NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm.

Let's say I load a PE file, which happens to be a 64-bit Windows driver. I may then see in the Output pane (redacted for brevity):

IDA is analysing the input file...
You may start to explore the input file right now.
...
Using FLIRT signature: Windows Driver Kit 7/10 64bit
Propagating type information...

Now "Windows Driver Kit 7/10 64bit" corresponds to $IDADIR/sig/pc/ms64wdk.sig (found with dumpsig). Fair enough. I also know that $IDADIR/sig/pc/autoload.cfg governs what type information library (.til) file gets loaded based on the loading of a signature.

Alas, there is no entry that maps the aforementioned $IDADIR/sig/pc/ms64wdk.sig to ntddk64_win7 and ntapi64_win7. Yet, when I use Produce file -> Dump database to IDC file... the resulting .idc file has the following calls among its first actions (again redacted for brevity):

#define UNLOADED_FILE   1
#include <idc.idc>

static main(void) {
    // ...
    GenInfo();            // various settings
    // ...
}

static GenInfo(void) {

    // ...
    add_default_til("ntddk64_win7");
    add_default_til("ntapi64_win7");
}

Questions:

  • How does IDA make the connection between the FLIRT (.sig) and the .til here? (Apparently $IDADIR/sig/pc/autoload.cfg has no bearing.)
  • Given there are also other .til files like ntddk64_win10.til, ntapi64_win10.til:
    • How can I configure IDA to load those instead of the somehow implicit ntddk64_win7 and ntapi64_win7 respectively?
    • Assuming I can't override the behavior or have an existing IDB which had the implicit ntddk64_win7 and ntapi64_win7 applied: If I now use add_default_til("ntddk64_win10") and add_default_til("ntapi64_win10") (no matter whether IDC or IDAPython) will this adversely affect existing usage of type information (e.g. enums which were imported from standard enums)? How does it affect existing usage?
  • What is the relation between the ntddk64.til and, say, ntddk64_vista.til, ntddk64_win7.til, ntddk64_win8.til, ntddk64_win81.til and ntddk64_win10.til? Is ntddk64.til the superset? Some subset?

PS: Pointers to official documentation very much welcome.

1
  • Meanwhile I noticed, that a bunch of those names are hardcoded in some of the loaders, processors and plugins that come with IDA, as well as the ida.dll and ida64.dll. So there's clearly more than autoload.cfg at work here.
    – 0xC0000022L
    Commented Jan 11, 2023 at 16:35

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.