Created
October 29, 2015 17:52
-
-
Save luser/d07ed10249090ec27dc9 to your computer and use it in GitHub Desktop.
Dump PDB information from a PE file
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <stdint.h> | |
#include <Windows.h> | |
#include <string> | |
#include <DbgHelp.h> | |
#pragma comment(lib, "dbghelp.lib") | |
const DWORD CV_SIGNATURE_RSDS = 0x53445352; // 'SDSR' | |
struct CV_INFO_PDB70 { | |
DWORD CvSignature; | |
GUID Signature; | |
DWORD Age; | |
BYTE PdbFileName[1]; | |
}; | |
void print_guid(const GUID& guid) | |
{ | |
printf("%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X", | |
guid.Data1, guid.Data2, guid.Data3, | |
guid.Data4[0], guid.Data4[1], guid.Data4[2], guid.Data4[3], | |
guid.Data4[4], guid.Data4[5], guid.Data4[6], guid.Data4[7]); | |
} | |
int main(int argc, char** argv) | |
{ | |
HANDLE file = CreateFileA(argv[1], | |
GENERIC_READ, | |
FILE_SHARE_READ, | |
nullptr, | |
OPEN_EXISTING, | |
FILE_ATTRIBUTE_NORMAL, | |
nullptr); | |
if (file == INVALID_HANDLE_VALUE) { | |
fprintf(stderr, "Couldn't open file: %s\n", argv[1]); | |
return 1; | |
} | |
HANDLE mapFile = CreateFileMappingA(file, NULL, PAGE_READONLY, 0, 0, 0); | |
if (mapFile == nullptr) { | |
fprintf(stderr, "Couldn't create file mapping\n"); | |
CloseHandle(file); | |
return 1; | |
} | |
uint8_t* base = reinterpret_cast<uint8_t*>(MapViewOfFile(mapFile, | |
FILE_MAP_READ, | |
0, | |
0, | |
0)); | |
if (base == nullptr) { | |
fprintf(stderr, "Couldn't map file\n"); | |
CloseHandle(mapFile); | |
CloseHandle(file); | |
return 1; | |
} | |
DWORD size; | |
PIMAGE_DEBUG_DIRECTORY debug_dir = | |
reinterpret_cast<PIMAGE_DEBUG_DIRECTORY>( | |
ImageDirectoryEntryToDataEx(base, | |
FALSE, | |
IMAGE_DIRECTORY_ENTRY_DEBUG, | |
&size, | |
nullptr)); | |
bool found = false; | |
if (debug_dir->Type == IMAGE_DEBUG_TYPE_CODEVIEW) { | |
fprintf(stderr, "PointerToRawData: 0x%x\n", debug_dir->PointerToRawData); | |
CV_INFO_PDB70* cv = | |
reinterpret_cast<CV_INFO_PDB70*>(base + debug_dir->PointerToRawData); | |
if (cv->CvSignature == CV_SIGNATURE_RSDS) { | |
found = true; | |
printf("%s ", cv->PdbFileName); | |
print_guid(cv->Signature); | |
printf("%x\n", cv->Age); | |
} | |
} | |
UnmapViewOfFile(base); | |
CloseHandle(mapFile); | |
CloseHandle(file); | |
return found ? 0 : 1; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment