Where Can I Get .PDB files for Windows OS Components?

Question

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to actually retrieve the .PDB of choice from it.

While this question is similar to mine, the answers do not include how to statically load a .pdb of choice during disassembly rather than automatically load it from the environment variables while debugging.

How can I download a specific .PDB for a Windows binary?

Answer 1

official way is as pointed out by other answers use symchk.exe from windbg installation

but you can also fetch it by putting together few dbghelp and winsock functions

find below a poc that uses wget.exe

#include <stdio.h>
#include <windows.h>
#include <dbghelp.h>
#pragma comment(lib,"dbghelp.lib")
#pragma comment(lib,"user32.lib")
const char *formatstr =
"wget -c -U=\"Microsoft-Symbol-Server/10.0.0.0\" "
"\"http://msdl.microsoft.com/download/symbols/"
"%s/%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x%x/%s\"";
char fetchpdb[0x1000];
int main(int argc,char *argv[]) {
    if(argc !=2){
        printf("usage %s path to binary\n",argv[0]);
        exit(0);
    }
    SYMSRV_INDEX_INFO syminf ={0};
    syminf.sizeofstruct = sizeof(SYMSRV_INDEX_INFO);
    BOOL ret = SymSrvGetFileIndexInfo(argv[1],&syminf,0);
    if(ret) {
        wsprintfA(
        fetchpdb,formatstr,syminf.pdbfile,syminf.guid.Data1,
        syminf.guid.Data2, syminf.guid.Data3,syminf.guid.Data4[0],
        syminf.guid.Data4[1],syminf.guid.Data4[2],syminf.guid.Data4[3],
        syminf.guid.Data4[4],syminf.guid.Data4[5],syminf.guid.Data4[6],
        syminf.guid.Data4[7],syminf.age,syminf.pdbfile
        );
        // Depricated use CreateProcess and/or Winsock functions needs wget.exe in path
        WinExec(fetchpdb,1);
    }
    else {
        printf("%x\n",GetLastError());
    }
    return 0;
}

Answer 2

You can use the symchk tool shipped with the Windows SDK to automate this process.

IIRC it goes similar to this:

symchk /v /r c:\myfiles /s srv*c;\symbols*https://msdl.microsoft.com/download/symbols

This will go through the PE files in c:\myfiles, fetch the PDBs from MS symbol server and cache them in c:\symbols.

Answer 3

You can download all symbols with:

"C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\symchk.exe" /r c:\windows /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols

https://www.bleepingcomputer.com/news/microsoft/microsoft-is-no-longer-providing-offline-msi-symbol-packages/