3

In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do?

./libr/bin/d/dll/csmfpapi.sdb
./libr/bin/d/dll/atl.sdb
./libr/bin/d/dll/msvbvm60.sdb
./libr/bin/d/dll/msi.sdb
./libr/bin/d/dll/mfc90u.sdb
./libr/bin/d/dll/msvbvm50.sdb
./libr/bin/d/dll/dsound.sdb
./libr/bin/d/dll/mfc71.sdb
./libr/bin/d/dll/olepro32.sdb
4

SDB stands for String Database.

sdb is a simple string key/value database based on cdb disk storage and supports JSON and arrays introspection.

You can see the SDB commands listed with the k command,

|Usage: k[s] [key[=value]]Sdb Query
| k foo=bar                 set value
| k foo                     show value
| k                         list keys
| ko [file.sdb] [ns]        open file into namespace
| kd [file.sdb] [ns]        dump namespace to disk
| ks [ns]                   enter the sdb query shell
| k anal/meta/*             ist kv from anal > meta namespaces
| k anal/**                 list namespaces under anal
| k anal/meta/meta.0x80404  get value for meta.0x80404 key

There's a whole post about it in radare2 blog, check it out here.
You can read more about it in this link from radare2's repository.
There's also a short, and not so detailed, chapter about it in r2book.


Edit: You added another question so I'll expand my answer accordingly.
These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each dll in ./libr/bin/d/dll/. Each file contains a key-value line in this format:

ordinal_num=export_name
another_ordinal_num=another_export_name

So, if we'll take msi.dll from the list you've mentioned, its sdb file will look like this:

...
232=Migrate10CachedPackagesW
1=MsiAdvertiseProductA
223=MsiAdvertiseProductExA
224=MsiAdvertiseProductExW
2=MsiAdvertiseProductW
...

These files are then compiled by MakeFile. To add sdb files for DLL you can follow "sdb_ordinal.md" article from radare2 docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.