4

Is ImageBase of a PE binary present in its PDB or can it only be retrieved from the binary?

I have studied both Microsoft's PDB sources and LLVM docs without much luck finding it.

In the DBI stream there exist section headers with section RVAs, but I couldn't find any trace of their corresponding VAs or the base address itself.

1 Answer 1

4

I believe this information is not stored within the PDB files in any recent versions.

Microsoft's DIA SDK used for dumping information contained in PDB files does provide a method named get_virtualAddress (as opposed to get_relativeVirtualAddress) which should, in theory, return the real virtual address of a static symbol (segment, section, frame data etc.), however both of these methods currently return the same value (RVA) in all test cases I've tried. The implementations of two methods are different though, suggesting that there could be some use cases where the VAs are in fact stored within the data.

Keep in mind that the PDB format dates back to 90s, so if I had to guess I'd say that the actual VA's were contained within PDB files back before ASLR was introduced. This is, of course, only speculation on my part.

1
  • 1
    That's what I assumed too and instead extracted the imagebase directly from binary with IDAPython, thanks
    – mimak
    Commented May 16, 2023 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.