7 votes

Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?

You can use PDB downloader which doesn’t require any installation https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader. Or you could use its source below to see how you could ...
chentiangemalc's user avatar
6 votes
Accepted

How to add standard symbolic constants with bitwise operators (like ORs)

You could create a bitfield enum. Since the enum containing PROCESS_VM_READ already exists in the MSSDK type library, we are going to copy that and modify it to become a bitfield. Go to the enums ...
kennytm's user avatar
  • 466
5 votes

Symbols visible in EXE file without PDB

dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes

How to configure IDA to load .pdb files from Microsoft public symbol server?

It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is: Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
Steven Liang's user avatar
4 votes

Can I force GDB breakpoints and disassemble?

gdb is primarily a Source Level Debugger to set a bp on an address instead of symbol use * (gdb) break main Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4. (gdb) break *0x100401094 Note: ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

How to load a PDB file into x64dbg?

You can use symload/loadsym command. In the x64dbg console type: symload pdbconsoleapplication1,symbols\pdbconsoleapplication1.pdb,[0/1] With the last argument, you can control if the validation of ...
Paweł Łukasik's user avatar
3 votes
Accepted

Load PDB for MemoryModule-loaded DLL in x64dbg

x64dbg has the virtualmod command, which (in theory) can be used to detect modules loaded from memory, rather than via LoadLibrary* APIs: virtualmod Tell the debugger to treat a memory range as a ...
ynwarcs's user avatar
  • 411
3 votes

Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?

With the same issue, I made a PowerShell script based on PDB-Downloader. You can find it in my GitHub. It Requires PowerShell 7.3 or newer. In action: PS: Help me test it.
Francisco Nabas's user avatar
3 votes
Accepted

How to extract debug information from a DOS executable compiled with Watcom C/C++?

OpenWatcom includes the wdump utility which can dump the debug info (if it's present).
Igor Skochinsky's user avatar
  • 36.5k
3 votes

Using debug symbols of an older exe for a newer exe

you probably can't use I as-is but there some possibilities: apply symbols to the version 1.1 then use some binary diffing/porting tool to find the matching functions in the version 1.5. if you don't ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

PE: Strange entry in debug directory (Type: 0xc)

If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there: #define IMAGE_DEBUG_TYPE_UNKNOWN 0 #define IMAGE_DEBUG_TYPE_COFF 1 #define ...
Paweł Łukasik's user avatar
3 votes
Accepted

Is all debug information of VS-compiled PE files contained in an external PDB file?

Old versions of link.exe supported the /debugtype argument that used these options: /debugtype:coff use COFF format /debugtype:cv use CodeView or Program Database format (depends on /pdb ...
josh poley's user avatar
3 votes
Accepted

Obtain .exe/.dll/.sys for a given .pdb file

the binaries (exe , sys , dll ) are fetched from ms symbol servers by their time_date_stamp and size the windbg command !chkimg normally fetches the binaries for minidumps and it uses ...
blabb's user avatar
  • 16.3k
3 votes
Accepted

How are members of a Structure Type positioned on the stack?

The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
Michael Karcher's user avatar
2 votes

Find functions names in .init_array section in unstripped library

This can easily be achieved with radare2. I have this version installed [rese] r2 -v radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9 commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 ...
sudhackar's user avatar
  • 2,639
2 votes

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

I fixed it by Setting the environment variable _NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols then tick the "auto load PDB files" in Debugger Options
sklaw's user avatar
  • 21
2 votes

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system ...
Igor Skochinsky's user avatar
  • 36.5k
2 votes

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc with symbols it would be like call dword ptr ds:[exitprocess] call foo32!...
blabb's user avatar
  • 16.3k
2 votes

GHIDRA: How to load symbols from a text (map) file

It's not certain that the particular map file you have is supported out of the box, but you should be able to use the Script Manager from the Window menu in Ghidra (in the Code Browser!). A good start ...
0xC0000022L's user avatar
  • 10.9k
1 vote

analyze how data is read in android usb device

You have two possible approaches in here: Analyze the APK of the device, reverse engineer it and try to make sense of how it communicates with the USB device. Connect the USB device to a computer, ...
Abdullah Mohamed's user avatar
1 vote

WinDBG doesn't resolve function names when debugging kernel module

these should be comments but it grew up what is the windbg version ? what is the os version ? what is the output of lm m "your specific Module" are the symbols loaded for your Module ? have ...
blabb's user avatar
  • 16.3k
1 vote
Accepted

How is padding size calculated for members of structure types?

The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. ...
Michael Karcher's user avatar
1 vote

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

you must load pdb file when you pause this application, it must be paused state.
boo's user avatar
  • 111
1 vote

GHIDRA: How to load symbols from a text (map) file

Wow that 'ImportSymbolsScript' helped. I 'turned down' that mapfile from ... Address Publics by Value 0001:0000 byte_0 0001:001A start 0001:00D1 __nomain 0001:00D8 ...
Nadu's user avatar
  • 158
1 vote

Does the Radare Debugger support STABS?

radare2 is not a source level debugger, thus there is no support for STABS. That said, you can always use gdb as a backend for radare2 either by connecting radare2 to a running gdb session or by using ...
Megabeets's user avatar
  • 8,959
1 vote

Obtain .exe/.dll/.sys for a given .pdb file

Haven't tried it, but SymFindExecutableImage might work if the image is present on the symbol server. I know that WinDbg/Visual Studio are able in some cases download images referenced in the crash ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

How to extract debug information from a DOS executable compiled with Watcom C/C++?

This web site: http://www.exphys.jku.at/Skripten/PK_PROG/Watcom.pdf is a PDF that (step by step) explains how to debug such files.
user3629249's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible