A few weeks ago I already twittered a screenshot that showed what disassembled code looks like in IDA Pro after automatically importing function information from MSDN. Today, I have finally managed to upload our IDA Pro script, ida-msdn, to the zynamics GitHub account. If you are analyzing Windows executable files in IDA Pro you can now benefit from automated API calls documentation.
kernel32.dll after importing function information from MSDN
There is a slight problem, however. Since we can not distribute the MSDN documentation ourselves for legal reasons, you need to have your own local installation of the MSDN. Furthermore, the import process is divided into two parts.
At first you have to parse your local MSDN documentation into an XML file. This can be done with msdn-crawler, another open source zynamics project. msdn-crawler parses your locally installed Windows API documentation files from the MSDN and generates an XML file that contains information about Windows API functions (description, argument names and descriptions, and return values). In this first version, msdn-crawler finds 33984 Windows API functions in the MSDN and generates an XML file that contains more than 30 MB of function information. To see a brief example of what the XML file looks like, please check the readme.txt file on GitHub.
Once you have generated the msdn.xml file with msdn-parser you can use ida-msdn to import Windows API documentation into arbitrary IDB files. ida-msdn does two things: First, ida-msdn tries to match imported functions found in the IDB file to function information from the XML file. When information about an imported function is found, the information is imported from the XML file into the IDB file. Second, ida-msdn tries to find out if you are actually working on a DLL file (like shell32.dll or user32.dll) that exports Windows API functions. In that case, the exported functions recognized by ida-msdn are annotated with information from the XML file too.
Happy MSDN importing. 🙂
Amazing, I’ve been looking forward to see a plugin like this 🙂
Hello, Sebastian.
Thanks a lot for script ).
But msdn-crawler does not work for me =( He print error message on string content = text_file.read().translate(None, “rn”)
Wihout .translate(None, “rn”), he parse decompiled help files, but nothing found in htm files.
I use SDK for Windows Server 2003, please help, my knownledge in python is very bad =(
@izlesa, i have fixed that and some other problems will send across the patch to Sebastian in day or two.
Sweet, thanks. I am traveling until Tuesday so I can’t look at the issue now.
where do i send you that patch. Githug is ugly I tried posting there 😐
@izlesa, that error is due to unrecognized ‘None’ object, when you are using python version earlier to 2.6.
you can fix that by using the below line instead
content = text_file.read().translate(string.maketrans(”,”), “rn”)
and for the parsing of functions properly, even i ran into different decompilation output from hxs files than what parser expects to see, the decompiled files did not have decscription tags of form “<meta name="Description""
and so script couldn't get the data right.
apparently there is a version difference…
I used MSDN 2008, and hxcomp.exe from 2008 SDK.
I have couple of fixups for that as well. But The dataset is huge so hard to verify. May you can try the updated version when Sebastian updates that.
Hi n,
please send your patches to sebastian.porst@zynamics.com. Just send me the whole script please, I’ll diff it myself.
Greets,
sp
I used Python 2.6 and the Windows 7 SDK as described in the README file, the msdn-crawler script worked well but has thrown a number of warnings. If you’re interested contact me by email and I’ll send you the output of the script.
Thanks a lot for all ))
Can I suggest a small patch to ida_import.py? You can eliminate the need to hardcode a file path if you replace this line:
functions = parse(“C:\code\tools\msdn-crawler\msdn.xml”)
With this:
functions = parse(os.path.join(os.path.split(__name__)[0], “msdn.xml”))
The msdn.xml file can be placed in the same folder as ida_plugin.py.
My bad, it should have been:
functions = parse(os.path.join(os.path.split(sys.modules[__name__].__file__)[0], “msdn.xml”))
Also the “os” and “sys” modules have to be imported.
Perhaps I’m missing something, but is the argument labeling seen in your screenshot missing in the public release of the ida importer? It doesn’t seem to label anything aside from functions themselves.
Thanks for the scripts, the idea is great.
Hi vx,
you are not missing anything. I screwed that part up (and I am not even sure how, for some unexplainable reason that part of the code got lost). I will publish an update with argument labeling probably later this week.
Could anyone share their method for decompiling all the .hxs files with hxcomp.exe? Did you guys make a batch file of some sort?
Hi Alex,
try this from the console:
for /R %x in (*.hxs) do hxcomp -u “%x”
Make that ‘%x’ to properly handle spaces in hxs file path (not sure why double quotes didnt work) and it works like a charm, thanks Sebastian.
for /R %x in (*.hxs) do hxcomp -u ‘%x’
[…] MSDN Parser (IDA Pro plugin for importing MSDN documentation, more info here) […]
[…] infomación de MSDN: podéis ver como hacerlo en este post de Zynamics, quizá incluso agobiante tanta información pero útil si vas […]
How do you get the api information to show up as a comment and so extensively? I can only see the API information when I mouse over the function call. Also in the screenshot it shows comments for even the arguments! Mine does not. Only the definition for the function. IDApro 5.6.
[…] infomación de MSDN: podéis ver como hacerlo en este post de Zynamics, quizá incluso agobiante tanta información pero útil si vas […]
[…] infomación de MSDN: podéis ver como hacerlo en este post de Zynamics, quizá incluso agobiante tanta información pero útil si vas […]
Nice job on the plugin! Just to get this right: do I have to rerun it every time I load a new executable?
[…] I was doing this I ran across a Zynamics script which purports to import function details from MSDN documentation into IDA. To cut a long story short you need hxcomp.exe which as you can […]
I get the following error message, when I try to execute for /R %x in (*.hxs) do hxcomp -u “%x” from the console: Compiler could not load message ressources. Terminating.
Also tried for /R %x in (*.hxs) do hxcomp -u ‘%x’. But it does not worked. Does anyone have a hint ?
Hello, can someone make a complete example how to install/use that ? Is there a tutorial/example or something like that which shows how to use it ? It would be great…
best regard