2

From this question: Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?

and the answer from @chentiangemalc:

You can also look for structure starting with signature RSDS (0x53445352),   
is followed by a GUID (16 bytes), 
a counter (4 bytes) and then the PDB pathname.

This works for most cases.

Except for this one:

I have a dll System.Collections.dll and imported to dotpeek. The GUID is 016f38124dcc4f82a73b12c7baf82e3e which doesn't work.

https://msdl.microsoft.com/download/symbols/System.Collections.pdb/016f38124dcc4f82a73b12c7baf82e3eFFFFFFFF/System.Collections.pdb

enter image description here

The dotpeek loaded the pdb from blew url:

Downloader: http://msdl.microsoft.com/download/symbols/system.collections.pdb/552b6fdf67184d5ab8ee8c8887f505b2FFFFFFFF/system.collections.pdb -> ok, 41.9 KB

Not sure where 552b6fdf67184d5ab8ee8c8887f505b2FFFFFFFF comes from?

This is the result from dumpbin:

Debug Directories

    Time Type        Size      RVA  Pointer
-------- ------- -------- -------- --------
C8A1BD67 cv            66 00009F38     8138    Format: RSDS, {016F3812-4DCC-4F82-A73B-12C7BAF82E3E}, 1, /_/artifacts/obj/System.Collections/ref/net6.0-Release/System.Collections.pdb
00000000 pdbhash       27 00009F9E     819E    SHA256: 12 38 6F 01 CC 4D 82 5F 67 3B 12 C7 BA F8 2E 3E 67 BD A1 48 68 C7 9C 0F 1A 0E 5C 92 0D E7 E9 EC
00000000 repro          0 00000000        0
4
  • Have you considered searching via winbindex.m417z.com/?file=system.collections.dll ...? Also of relevance this and this and -- if you know Python -- this.
    – 0xC0000022L
    Sep 6, 2023 at 21:13
  • Also iirc ms introduced a portable pdb format mostly targeting c# .net bin with magic BJSB NOT sure if those pdbs follow the guid age format
    – blabb
    Sep 7, 2023 at 5:42
  • Aside from @blabb's remark, I also recall that thanks to /Brepro the timestamp values are now deterministic and so different binaries (different file hashes) may share the same code and the same symbols.
    – 0xC0000022L
    Sep 7, 2023 at 9:58
  • Thanks guys. The dll I posted is a reference assembly which doesn't have symbols uploaded. What we really need is the corresponding implementation assembly.
    – Min Huang
    Oct 18, 2023 at 9:00

1 Answer 1

1

though both portable pdb and /Brepro are recent developments post the GUID age compressed file format of pdb

for your specific case the pdb does not seem to exist in ms symbol servers.

:\>wget -c -U="Microsoft-Symbol-Server/10.0.0.0" "http://msdl.microsoft.com/download/symbols/system.collections.pdb/016F38124DCC4F82A73B12C7BAF82E3E1/system.collections.pdb"

HTTP request sent, awaiting response... 404 Not Found <<<<<<<<<<<<<<<<<<<<<<-----------------
2023-09-07 21:32:02 ERROR 404: Not Found.


:\>wget -c -U="Microsoft-Symbol-Server/10.0.0.0" "http://msdl.microsoft.com/download/symbols/system.collections.pdb/552B6FDF67184D5AB8EE8C8887F505B21/system.collections.pdb"

HTTP request sent, awaiting response... 200 OK
Length: 284160 (278K) [application/octet-stream]
Saving to: 'system.collections.pdb'

100%[==============================================================================>] 284,160      249KB/s   in 1.1s

2023-09-07 21:32:07 (249 KB/s) - 'system.collections.pdb' saved [284160/284160]

you can check this answer of mine for some more relevant details about fetching the pdb without dbghelp or symsrv by using utilities like wget,curl,httpget etc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.