Importing MSDN documentation into IDA Pro

by

A few weeks ago I already twittered a screenshot that showed what disassembled code looks like in IDA Pro after automatically importing function information from MSDN. Today, I have finally managed to upload our IDA Pro script, ida-msdn, to the zynamics GitHub account. If you are analyzing Windows executable files in IDA Pro you can now benefit from automated API calls documentation.

kernel32.dll after importing function information from MSDN

There is a slight problem, however. Since we can not distribute the MSDN documentation ourselves for legal reasons, you need to have your own local installation of the MSDN. Furthermore, the import process is divided into two parts.

At first you have to parse your local MSDN documentation into an XML file. This can be done with msdn-crawler, another open source zynamics project. msdn-crawler parses your locally installed Windows API documentation files from the MSDN and generates an XML file that contains information about Windows API functions (description, argument names and descriptions, and return values). In this first version, msdn-crawler finds 33984 Windows API functions in the MSDN and generates an XML file that contains more than 30 MB of function information. To see a brief example of what the XML file looks like, please check the readme.txt file on GitHub.

Once you have generated the msdn.xml file with msdn-parser you can use ida-msdn to import Windows API documentation into arbitrary IDB files. ida-msdn does two things: First, ida-msdn tries to match imported functions found in the IDB file to function information from the XML file. When information about an imported function is found, the information is imported from the XML file into the IDB file. Second, ida-msdn tries to find out if you are actually working on a DLL file (like shell32.dll or user32.dll) that exports Windows API functions. In that case, the exported functions recognized by ida-msdn are annotated with information from the XML file too.

Happy MSDN importing. :)

24 Responses to “Importing MSDN documentation into IDA Pro”

  1. Mario Vilas Says:

    Amazing, I’ve been looking forward to see a plugin like this :)

  2. izlesa Says:

    Hello, Sebastian.
    Thanks a lot for script ).
    But msdn-crawler does not work for me =( He print error message on string content = text_file.read().translate(None, “\r\n”)

    Wihout .translate(None, “\r\n”), he parse decompiled help files, but nothing found in htm files.
    I use SDK for Windows Server 2003, please help, my knownledge in python is very bad =(

  3. n Says:

    @izlesa, i have fixed that and some other problems will send across the patch to Sebastian in day or two.

    • Sebastian Porst Says:

      Sweet, thanks. I am traveling until Tuesday so I can’t look at the issue now.

      • n Says:

        where do i send you that patch. Githug is ugly I tried posting there :|

  4. karthik Says:

    @izlesa, that error is due to unrecognized ‘None’ object, when you are using python version earlier to 2.6.
    you can fix that by using the below line instead

    content = text_file.read().translate(string.maketrans(”,”), “\r\n”)

    and for the parsing of functions properly, even i ran into different decompilation output from hxs files than what parser expects to see, the decompiled files did not have decscription tags of form “<meta name="Description""
    and so script couldn't get the data right.
    apparently there is a version difference…
    I used MSDN 2008, and hxcomp.exe from 2008 SDK.

    • n Says:

      I have couple of fixups for that as well. But The dataset is huge so hard to verify. May you can try the updated version when Sebastian updates that.

  5. Mario Vilas Says:

    I used Python 2.6 and the Windows 7 SDK as described in the README file, the msdn-crawler script worked well but has thrown a number of warnings. If you’re interested contact me by email and I’ll send you the output of the script.

  6. izlesa Says:

    Thanks a lot for all ))

  7. Mario Vilas Says:

    Can I suggest a small patch to ida_import.py? You can eliminate the need to hardcode a file path if you replace this line:

    functions = parse(“C:\\code\\tools\\msdn-crawler\\msdn.xml”)

    With this:

    functions = parse(os.path.join(os.path.split(__name__)[0], “msdn.xml”))

    The msdn.xml file can be placed in the same folder as ida_plugin.py.

  8. Mario Vilas Says:

    My bad, it should have been:

    functions = parse(os.path.join(os.path.split(sys.modules[__name__].__file__)[0], “msdn.xml”))

    Also the “os” and “sys” modules have to be imported.

  9. vx Says:

    Perhaps I’m missing something, but is the argument labeling seen in your screenshot missing in the public release of the ida importer? It doesn’t seem to label anything aside from functions themselves.

    Thanks for the scripts, the idea is great.

    • Sebastian Porst Says:

      Hi vx,

      you are not missing anything. I screwed that part up (and I am not even sure how, for some unexplainable reason that part of the code got lost). I will publish an update with argument labeling probably later this week.

  10. Alex Says:

    Could anyone share their method for decompiling all the .hxs files with hxcomp.exe? Did you guys make a batch file of some sort?

    • Sebastian Porst Says:

      Hi Alex,

      try this from the console:

      for /R %x in (*.hxs) do hxcomp -u “%x”

  11. Alex Says:

    Make that ‘%x’ to properly handle spaces in hxs file path (not sure why double quotes didnt work) and it works like a charm, thanks Sebastian.

    for /R %x in (*.hxs) do hxcomp -u ‘%x’

  12. Product updates: BinCrowd, PDF Tool, MSDN parser « blog.zynamics.com Says:

    [...] MSDN Parser (IDA Pro plugin for importing MSDN documentation, more info here) [...]

  13. Explota al máximo tu IDA Pro | It should work... Says:

    [...] infomación de MSDN: podéis ver como hacerlo en este post de Zynamics, quizá incluso agobiante tanta información pero útil si vas [...]

  14. Jamaal Speights Says:

    How do you get the api information to show up as a comment and so extensively? I can only see the API information when I mouse over the function call. Also in the screenshot it shows comments for even the arguments! Mine does not. Only the definition for the function. IDApro 5.6.

  15. Explotá al máximo IDA Pro: los mejores plugins - GodSys.com.ar Says:

    [...] infomación de MSDN: podéis ver como hacerlo en este post de Zynamics, quizá incluso agobiante tanta información pero útil si vas [...]

  16. Explotá al máximo IDA Pro: los mejores plugins « GodSys Says:

    [...] infomación de MSDN: podéis ver como hacerlo en este post de Zynamics, quizá incluso agobiante tanta información pero útil si vas [...]

  17. er4z0r Says:

    Nice job on the plugin! Just to get this right: do I have to rerun it every time I load a new executable?

  18. Acquiring hxcomp.exe without having Visual Studio installed | Technical Problems Says:

    [...] I was doing this I ran across a Zynamics script which purports to import function details from MSDN documentation into IDA. To cut a long story short you need hxcomp.exe which as you can [...]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Follow

Get every new post delivered to your Inbox.

Join 39 other followers

%d bloggers like this: