0

in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File).

I know how to load a PDB-File via GUi but I need this scripted.

Has anybody an idea how to do this?

Thanks in advance :-)

greetz Daniel :-)

1 Answer 1

2

According to the SDK, the PDB loader is implemented as an IDA plugin (see the SDK, e.g: \idasdk67\plugins\pdb).

The plugin name is "pdb", so you can call the plugin directly, like this:

idaapi.load_and_run_plugin("pdb", call_code)

Where call_code is an enum defined in \idasdk67\plugins\pdb\common.h,

0, 1 and 2 are already defined and will ask for user input, but if you want to silently load a pdb for the actually loaded PE file, you can pass a value greater than 2, e.g.:

idaapi.load_and_run_plugin("pdb", 3)

That should do the trick (at least it worked for me :)

Python>idaapi.load_and_run_plugin("pdb", 3)
PDB: using DIA dll "C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll"
PDB: DIA interface version 9.0
ntkrpamp.pdb: not found, trying with the input file Z:\Reverse\Windows\win8.1\x86\6.3.9600\ntoskrnl.exe
Trying loadDataForExe with ffffffff
loadDataForExe: 0
PDB: loaded 2055 types
PDB: total 22027 symbols loaded for Z:\Reverse\Windows\win8.1\x86\6.3.9600\ntoskrnl.exe
True
2
  • at first thx al lot for your fast reply :-) It seems like that this plugin points in the right direction, but unfortunately I have to find a way to tell IDA to search/load the PDB-File for a certain path. I looked in \idasdk67\plugins\pdb\ but coulnd't find anything useful :-/ Thanks again for your help :-)
    – Daniel
    Commented Feb 9, 2015 at 15:34
  • @Daniel Why not going the other way around: append the desired path for your PDBs to your _NT_SYMBOL_PATH so IDA can find it?
    – Neitsa
    Commented Feb 13, 2015 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.