IDA/Ghidra Type libraries

[mrexodia]

Would be nice to create IDA/Ghidra type libraries from the latest phnt version and include those in the release as well.

There's some issues:

• IDA SDK is non-free and it's difficult to use it on GH Actions
• Their parser is absolutely horrible and unlikely to parse the headers correctly

[nblog]

This is not a promotion, ghidra 10.3.2 and later, C-Parser can do it easily.
But so far, there's a very small problem，PreProcessor Token Error: Lexical error at line 2268, column 25. Encountered: "" (92), after : ""，which I've chosen to comment out

Here I provide a gdt built from the current repository as a demonstration of the effect.
vs2022_phnt_64.zip

[mrexodia]

Yeah, unfortunately the parser in IDA is awful. Thanks for investigating this though!

[Dump-GUY]

Hi. I hope it is convenient to mention it here. I needed this for a long time and this issue actually inspired me to kick my ass and do it. So here is IDA_PHNT_TYPES: Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays). I hope it will be useful. Thanks 👍
https://github.com/Dump-GUY/IDA_PHNT_TYPES

[HongThatCong]

I created another phnts til file, including ntgdi.h, ntsmss.h, ntuser.h, subprocesstag.h, usermgr.h, winsta.h
And almost 95% of the #define in phnt.h I put into corresponding enums.
I almost manually compare, edit the files in SystemInformer phnt header files

https://github.com/HongThatCong/IDA_TILs/tree/main/phnt

Tks @mrexodia for phnt amalgamate

Best regards,

[mrexodia]

Awesome, did you create those enums by hand or do you have some script for it? 👀

[HongThatCong]

Thanks @mrexodia
I created the enums by hand.
Had to read the .h source.
Think and name those enums based on function params, struct members name, name and meaning of the #define