What's ScyllaHide's PDBReaderx64.exe Doing?

Question

I just downloaded the binary of ScyllaHide for x64dbg. According to the instructions, I need to generate an NtApiCollection.ini file by running PDBReaderx64.exe or PDBReaderx86.exe. But I've got a long list of errors:

running PDBReaderx64.exe in win 7 64bit in a VM(virtualbox):

C:\work\reversetools\ScyllaHide_2019-05-31_22-45\Release>PDBReaderx64.exe

result:

OS ID: 6.1.1.0.1.9.x64
DBGHELP: No debug info for C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx
64.exe.  Searching for dbg file
DBGHELP: SymSrv load failure: symsrv.dll
DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx64.dbg - file not
found
DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\exe\PDBReaderx64.dbg - path
not found
DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\symbols\exe\PDBReaderx64.dbg
 - path not found
DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx64.dbg - file not
found
DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx64.exe missing deb
ug info.  Searching for pdb anyway
DBGHELP: Can't use symbol server for PDBReaderx64.pdb - no header information av
ailable
DBGHELP: PDBReaderx64.pdb - file not found
DBGHELP: PDBReaderx64 - no symbols loaded
DBGHELP: ntdll.pdb - file not found
DBGHELP: ntdll - export symbols
DBGHELP: kernel32.pdb - file not found
DBGHELP: kernel32 - export symbols
DBGHELP: kernelbase.pdb - file not found
DBGHELP: KERNELBASE - export symbols
DBGHELP: dbghelp.pdb - file not found
DBGHELP: dbghelp - export symbols
DBGHELP: msvcrt.pdb - file not found
DBGHELP: msvcrt - export symbols
DBGHELP: user32.pdb - file not found
DBGHELP: user32 - export symbols
DBGHELP: gdi32.pdb - file not found
DBGHELP: GDI32 - export symbols
DBGHELP: lpk.pdb - file not found
DBGHELP: LPK - export symbols
DBGHELP: usp10.pdb - file not found
DBGHELP: USP10 - export symbols
DBGHELP: imm32.pdb - file not found
DBGHELP: IMM32 - export symbols
DBGHELP: msctf.pdb - file not found
DBGHELP: MSCTF - export symbols
Failed to get VA for NtUserQueryWindow: The specified module could not be found.

Failed to get VA for NtUserBuildHwndList: The specified module could not be foun
d.
Failed to get VA for NtUserFindWindowEx: The specified module could not be found
.
Resolved user32.dll!NtUserBuildHwndList = 0
Resolved user32.dll!NtUserFindWindowEx = 0
Resolved user32.dll!NtUserQueryWindow = 0

seems like PDBReaderx64.exe is trying to look for some .dbg files but failed. Also the 3 resolved api's are having address = 0. I have no idea what went wrong as there is no information about what this PDBReaderx64.exe is doing. Any help?

Answer 1

This is an application that used to be part of ScyllaHide. It was responsible for finding addresses of undocumented (and unexported) functions in ntdll by downloading the Microsoft symbols and finding their address there. If you are interested you can find more information about the removal at https://github.com/x64dbg/ScyllaHide/commit/6817d32581b7a420322f34e36b1a1c8c3e4b434c.

PDBReader should no longer be necessary to use ScyllaHide. You can find the latest version always at https://github.com/x64dbg/ScyllaHide/releases.

Answer 2

I don't have 50 reps to comment, but PDBs are symbols. It's failing to load symsrv.dll, which tells me that you don't have the debugging tools installed? If so, you will need to install it: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools

After doing so, it SHOULD work. I haven't used PDBReader but when symbols are needed in the debugger, it'll just download them. Not sure if it will be the same for this one.