2

Radare has a format called a sdb. I asked a question here,

The answer I got was,

These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each dll in ./libr/bin/d/dll/.

One of the pages linked tells you how to make a sdb file, given a dll as input. I've done that. Now I see there are pdb files too.

|Usage: id Debug information
| Output mode:     
| '*'              Output in radare commands
| id               Source lines
| idp [file.pdb]   Load pdb file information
| idpi [file.pdb]  Show pdb file information
| idpd             Download pdb file on remote server

The specific sdb I've created is of a Microsoft dll. Moreover, I see Microsoft offers official pdb files.

  • Is there any advantage to using a pdb over an sdb?
  • Do these both convey the same information to the extent that adding a pdb when you already have a loaded sdb does nothing?

Looking at a function in question nothing changed when I loaded the pdb.

  • no pdb contains full debug information including but not limited to source line info and if you have a private pdb those have type info too to leversge the power if odb you may need to use windbg – blabb Jan 26 '18 at 7:54
4

While sdb files was created to translate imports that are referenced by ordinal instead of by name (see "Exporting Functions from a DLL by Ordinal Rather Than by Name"), pdb files are something entirely different.

Program Database

Program Database (PDB) file or DBG file are produced by the compiler. PDB files are used by developers to debug their program and is commonly removed from the binary before it distributed to the client. Most chances is that you won't find debug symbols inside most of the real-world binaries.

Symbol files hold a variety of data which are not actually needed when running the binaries, but which could be very useful in the debugging process.

PDB files typically contain:

  • Public symbols (typically all functions, static and global variables)
  • A list of object files that are responsible for sections of code in the executable
  • Frame pointer optimization information (FPO)
  • Name and type information for local variables and data structures
  • Source file and line number information

Microsoft publishes all the PDB files for all operating systems and other redistributed components on its symbol server. This makes it easy to debug an application that uses these DLL or executable files. You can use the Microsoft symbol server to resolve symbols, together with any local symbols for components that were built on your computer.

You can find more information about how radare2 interpret PDB files in the following links:

PDB vs SDB

As you probably figured out by now, SDB and PDB are two different things and for debugging purposes, PDB is much more helpful.

Further reading:

  • when you say referenced by ordinal instead of by name? does the pdb not also have the ordinal information for the symbol? Also, while you you certainly say how pdbs are more helpful it isn't clear to me coming into this how it's more helpful. How can I see the information added by the pdb in Name and type information for local variables and data structures It seems I have the same information before and after? I'd like to be able to see what the pdb added that radare didn't already know with the sdb. – Evan Carroll Jan 26 '18 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.