He has to go to his local municipality and get an application for a Firearms Purchaser ID card. Then he gives it to them completed, along with some cash (can't remember off the top of my head), and they'll fingerprint him many many times. If he's lucky, a few months later he'll get a call from the CLEO and he'll have his card. This is needed to buy rifles and shotguns (and airguns).
If he ever wants to buy a pistol he needs to apply and receive a pistol permit from his municipality for EVERY pistol he wants. I believe you can get more than one permit at a time, but they DO expire (after 90 days, I think).
He can buy rifles in post-ban configuration, including AR-15 style rifles. Pre-ban rifles are completely illegal (except for registered ones).
He can't have mags that can hold more than 15 rounds (unless they're registered along with a pre-ban rifle). He can temporarily block mags that hold more (with a wooden dowel or the like), but you better not be able to stuff a 16th round in one. The temporary blocking issue might change soon; they already tried once.
And the registration referred to above was closed 10 years ago.
Hollowpoints are illegal. Unless you're going from the store to the range, the store to your home, or your home to the range. Yeah, it's a strange law.
Tracers are illegal to shoot. I think they're ok to own, though. That doesn't make so much sense either.
Tell your friend if he wants any pistols to buy them now. The state is fixing to ban the sales of ALL of them except for the not-yet-existant "smart-guns."
I think that's everything.