7
votes
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
You can use PDB downloader which doesn’t require any installation https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader. Or you could use its source below to see how you could ...
- 1,235
5
votes
Accepted
How to add standard symbolic constants with bitwise operators (like ORs)
You could create a bitfield enum. Since the enum containing PROCESS_VM_READ already exists in the MSSDK type library, we are going to copy that and modify it to become a bitfield.
Go to the enums ...
- 456
5
votes
Symbols visible in EXE file without PDB
dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. ...
- 36.4k
5
votes
How to configure IDA to load .pdb files from Microsoft public symbol server?
It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is:
Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables
Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
- 151
4
votes
Can I force GDB breakpoints and disassemble?
gdb is primarily a Source Level Debugger
to set a bp on an address instead of symbol use *
(gdb) break main
Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.
(gdb) break *0x100401094
Note: ...
- 16.3k
4
votes
Accepted
How to load a PDB file into x64dbg?
You can use symload/loadsym command.
In the x64dbg console type:
symload pdbconsoleapplication1,symbols\pdbconsoleapplication1.pdb,[0/1]
With the last argument, you can control if the validation of ...
- 4,912
3
votes
Accepted
Load PDB for MemoryModule-loaded DLL in x64dbg
x64dbg has the virtualmod command, which (in theory) can be used to detect modules loaded from memory, rather than via LoadLibrary* APIs:
virtualmod
Tell the debugger to treat a memory range as a ...
- 191
3
votes
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
With the same issue, I made a PowerShell script based on PDB-Downloader. You can find it in my GitHub.
It Requires PowerShell 7.3 or newer.
In action:
PS: Help me test it.
3
votes
Accepted
How to extract debug information from a DOS executable compiled with Watcom C/C++?
OpenWatcom includes the wdump utility which can dump the debug info (if it's present).
- 36.4k
3
votes
Using debug symbols of an older exe for a newer exe
you probably can't use I as-is but there some possibilities:
apply symbols to the version 1.1 then use some binary diffing/porting tool to find the matching functions in the version 1.5.
if you don't ...
- 36.4k
3
votes
Accepted
PE: Strange entry in debug directory (Type: 0xc)
If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there:
#define IMAGE_DEBUG_TYPE_UNKNOWN 0
#define IMAGE_DEBUG_TYPE_COFF 1
#define ...
- 4,912
3
votes
Accepted
Is all debug information of VS-compiled PE files contained in an external PDB file?
Old versions of link.exe supported the /debugtype argument that used these options:
/debugtype:coff
use COFF format
/debugtype:cv
use CodeView or Program Database format (depends on /pdb ...
- 851
3
votes
Accepted
Obtain .exe/.dll/.sys for a given .pdb file
the binaries (exe , sys , dll ) are fetched from ms symbol servers by their time_date_stamp and size
the windbg command !chkimg normally fetches the binaries for minidumps and it uses ...
- 16.3k
3
votes
Accepted
How are members of a Structure Type positioned on the stack?
The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
- 921
2
votes
Find functions names in .init_array section in unstripped library
This can easily be achieved with radare2. I have this version installed
[rese] r2 -v
radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9
commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 ...
- 2,629
2
votes
IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging
I fixed it by
Setting the environment variable
_NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols
then tick the "auto load PDB files" in Debugger Options
- 21
2
votes
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system ...
- 36.4k
2
votes
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc
with symbols it would be like call dword ptr ds:[exitprocess]
call foo32!...
- 16.3k
2
votes
GHIDRA: How to load symbols from a text (map) file
It's not certain that the particular map file you have is supported out of the box, but you should be able to use the Script Manager from the Window menu in Ghidra (in the Code Browser!).
A good start ...
- 10.9k
1
vote
analyze how data is read in android usb device
You have two possible approaches in here:
Analyze the APK of the device, reverse engineer it and try to make sense of how it communicates with the USB device.
Connect the USB device to a computer, ...
- 168
1
vote
WinDBG doesn't resolve function names when debugging kernel module
these should be comments but it grew up
what is the windbg version ?
what is the os version ?
what is the output of lm m "your specific Module"
are the symbols loaded for your Module ?
have ...
- 16.3k
1
vote
Accepted
How is padding size calculated for members of structure types?
The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. ...
- 921
1
vote
IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging
you must load pdb file when you pause this application, it must be paused state.
- 111
1
vote
GHIDRA: How to load symbols from a text (map) file
Wow that 'ImportSymbolsScript' helped. I 'turned down' that mapfile from
...
Address Publics by Value
0001:0000 byte_0
0001:001A start
0001:00D1 __nomain
0001:00D8 ...
- 158
1
vote
Does the Radare Debugger support STABS?
radare2 is not a source level debugger, thus there is no support for STABS. That said, you can always use gdb as a backend for radare2 either by connecting radare2 to a running gdb session or by using ...
- 8,919
1
vote
Obtain .exe/.dll/.sys for a given .pdb file
Haven't tried it, but SymFindExecutableImage might work if the image is present on the symbol server. I know that WinDbg/Visual Studio are able in some cases download images referenced in the crash ...
- 36.4k
1
vote
How to extract debug information from a DOS executable compiled with Watcom C/C++?
This web site: http://www.exphys.jku.at/Skripten/PK_PROG/Watcom.pdf
is a PDF that (step by step) explains how to debug such files.
- 136
Only top scored, non community-wiki answers of a minimum length are eligible