In a reversing world it is a regular experience to come across samples that are linked to OS APIs that are imported from well-known libraries. However, on occasion we can come across files that use importing in a slightly different way – they import not via names but via ordinals. A good example are samples linking to MFC libraries.

When loaded into IDA, such samples contain lots of autogenerated function names f.ex. mfc_1234. This is pretty annoying. Of course (and luckily) there exists a lot descriptions and solutions to it – we need an IDT or an IDS file. An IDT (or its compressed version IDS) file is a ‘translator’ between ordinal numbers and actual API names – many of these exist in a default installation package of IDA, but not all… One can generate these by hand – using existing scripts – and in case the MS symbols exist for a given library – one can try to generate these automagically using a simple script I am attaching to this post.

This is the recipe:

• Ensure your IDA is set up to use symbols from Microsoft
• Open the MS library you analyze
• Load its symbols from the MS web site (you are either asked, or they are loaded automatically – depends on your config)
• When the database is fully loaded and autoanalysis is completed, launch the following script:

import idaapi
import idc
import types
import os

idt = GetIdbPath()

print "Original IDB: %s" % idt

idt = idt.replace('.idb','.idt')
idt = idt.replace('.i64','.idt')

dll = GetInputFile()

print "Saving to %s" % idt

f = open(idt, 'wb')
f.write("0 Name=%s\n" % (dll))
for i in xrange(idaapi.get_entry_qty()):
    fn = idaapi.getn_func(i)
    a = fn.startEA
    if a != BADADDR:
       eo = GetEntryOrdinal(i)
       nm = GetFunctionName(GetEntryPoint(eo))
       #cm = GetFunctionCmt(a,0)
       #print "%x: %0d, %s, %s" %  (a,eo,nm,cm)
       if nm!='':
          f.write("%d Name=%s\n" % (eo,nm))
f.close()
print "done!"

• Now you should have the IDT file autogenerated in the same directory where the library is f.ex.
  • mfcXYZ.idb
  • mfcXYZ.idt  — this is the IDT file
• You can now
  • Open sample linking to the MS library via ordinals
  • Load newly created IDT file
  • All mfc_1234 function names should be automatically converted to respective function/method names
• You can also use zipids.exe to convert IDT file to IDS, but it’s not necessary