2

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to actually retrieve the .PDB of choice from it.

While this question is similar to mine, the answers do not include how to statically load a .pdb of choice during disassembly rather than automatically load it from the environment variables while debugging.

How can I download a specific .PDB for a Windows binary?

1
  • I think, once you installed the Windows SDKs and use the WinDBG, all the PDBs or symbols that are needed will be downloaded automatically so you can choose the PDB locally. Dec 21 '20 at 5:36
1

official way is as pointed out by other answers use symchk.exe from windbg installation

but you can also fetch it by putting together few dbghelp and winsock functions

find below a poc that uses wget.exe

#include <stdio.h>
#include <windows.h>
#include <dbghelp.h>
#pragma comment(lib,"dbghelp.lib")
#pragma comment(lib,"user32.lib")
const char *formatstr =
"wget -c -U=\"Microsoft-Symbol-Server/10.0.0.0\" "
"\"http://msdl.microsoft.com/download/symbols/"
"%s/%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x%x/%s\"";
char fetchpdb[0x1000];
int main(int argc,char *argv[]) {
    if(argc !=2){
        printf("usage %s path to binary\n",argv[0]);
        exit(0);
    }
    SYMSRV_INDEX_INFO syminf ={0};
    syminf.sizeofstruct = sizeof(SYMSRV_INDEX_INFO);
    BOOL ret = SymSrvGetFileIndexInfo(argv[1],&syminf,0);
    if(ret) {
        wsprintfA(
        fetchpdb,formatstr,syminf.pdbfile,syminf.guid.Data1,
        syminf.guid.Data2, syminf.guid.Data3,syminf.guid.Data4[0],
        syminf.guid.Data4[1],syminf.guid.Data4[2],syminf.guid.Data4[3],
        syminf.guid.Data4[4],syminf.guid.Data4[5],syminf.guid.Data4[6],
        syminf.guid.Data4[7],syminf.age,syminf.pdbfile
        );
        // Depricated use CreateProcess and/or Winsock functions needs wget.exe in path
        WinExec(fetchpdb,1);
    }
    else {
        printf("%x\n",GetLastError());
    }
    return 0;
}
0

You can use the symchk tool shipped with the Windows SDK to automate this process.

IIRC it goes similar to this:

symchk /v /r c:\myfiles /s srv*c;\symbols*https://msdl.microsoft.com/download/symbols

This will go through the PE files in c:\myfiles, fetch the PDBs from MS symbol server and cache them in c:\symbols.

0

You can download all symbols with:

"C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\symchk.exe" /r c:\windows /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols

https://www.bleepingcomputer.com/news/microsoft/microsoft-is-no-longer-providing-offline-msi-symbol-packages/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.