raw_pdb icon indicating copy to clipboard operation
raw_pdb copied to clipboard

What is the equivalent of IDiaDataSource::loadDataForExe?

Open taodaqiao opened this issue 2 years ago • 1 comments

What is the equivalent of IDiaDataSource::loadDataForExe?

taodaqiao avatar Mar 23 '22 15:03 taodaqiao

Raw PDB does not provide this functionality.

In order to get the PDB that matches a certain EXE/PE file, you have to perform the following steps:

  • Fetch the sections from the PE file
  • Grab the IMAGE_DEBUG_DIRECTORY entries from the IMAGE_DIRECTORY_ENTRY_DEBUG in the data directory of the optional header
  • Look for the debug directory of type IMAGE_DEBUG_TYPE_CODEVIEW
  • Check if the raw data of the entry matches a PDB 7.0 header, and grab the info from there

This gives you the PDB path, GUID, and age. Using this PDB path, you have to check yourself whether the corresponding PDB file can either be found in the directory in which the PE file is stored, or at the absolute path given by the PDB path. Once a PDB file has been located, you then have to check whether its GUID and age match the ones stored in the PE debug directory.

This is quite a bit of very Win32/PE-specific code, so I don't believe the library itself should contain that. However, should more people need it, I could add an example for it.

MolecularMatters avatar Mar 28 '22 08:03 MolecularMatters