1

IDA Pro can automatically download and load .pdb files from symbol server. And now I want to write an IDAPython plugin to obtain some data from the .pdb file.

But I don't know how to get the file path of the already loaded .pdb file.
Can I get it using IDAPython?

1
  • iirc the pdb file name is printed in the header information scroll to the top and look
    – blabb
    Dec 13 '21 at 17:01
1

i just checked idafree 76 and i dont see an idc function to get the pdb file name
but as i commented it is printed in the header you can copy paste it

.text:0000000140001000 ; Alignment     : default
.text:0000000140001000 ; PDB File Name : C:\xx\Desktop\mulcall\mcall.pdb

or you can search text for string(".pdb") path is normally available in .rdata section IMAGE_DEBUG_DIRECTORY

using idc function like as below

auto cline;
cline = find_text(MinEA()+0x1000,1,0,0,".PDB");
jumpto(cline);
Message("%x\t%s\n" , cline , get_curline());

which should yield

14000206c .rdata:000000014000206C text "UTF-8",'C:\xxx\Desktop\mulcall\mcall.pdb',0 ; PdbFileName

be aware this is from debug directory and may not be correct in malwares , stripped , public , etc , manipulated binaries

for example a public pdb might return

1802420f0   .rdata:00000001802420F0   text "UTF-8", 'kernelbase.pdb',0 ; PdbFileName

in such cases like public pdbs of ms binaries best option is to use dumpbin /pdbpath

dumpbin /pdbpath c:\Windows\System32\KernelBase.dll

Dump of file c:\Windows\System32\KernelBase.dll

File Type: DLL
  PDB file found at 'f:\symbols\kernelbase.pdb\993F0EEA8C3C260F6D52724A7CA166601\kernelbase.pdb'
1
  • It's a good idea
    – Ox9A82
    Dec 14 '21 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.