There’s an age value tacked onto the end of that GUID. It is supposed to
indicate (as I understand it) the number of times that an image has been
modified since it was fully rebuilt, though I’m not sure that makes a lot
of sense to me.
Anyway, given a symbol directory entry:
$ dir ntkrnlmp.pdb
Volume in drive C is OS
Volume Serial Number is 2666-B35C
Directory of ntkrnlmp.pdb
03/21/2016 05:38 PM
.
03/21/2016 05:38 PM ..
03/21/2016 05:38 PM F7971FB6AA7E450CBCA7054A98D659421
dumpbin /HEADERS c:\windows\system32\ntoskrnl.exe | findstr /i /c:"RSDS"
56CD4410 cv 25 00256940 253B40 Format: RSDS,
{F7971FB6-AA7E-450C-BCA7-054A98D65942}, 1, ntkrnlmp.pdb
So it's the GUID (F7971FB6AA7E450CBCA7054A98D65942) + the age (1).
As Snoone said, you could creating this sort of reverse mapping if you want
to. It's all documented (for the PE, not the PDB) as part of the PE/COFF
spec.
Good luck,
mm
On Sun, Apr 10, 2016 at 12:09 PM, wrote:
> The linker generates this GUID to represent the specific invocation of
> link, it has nothing to do with the build number of Windows. That being
> said, if you know the GUID for a build you could create a reverse mapping
> database for GUID to build number (see !chksym for getting the GUID from a
> module). But why would you need this? It's unusual to want to go from PDB
> to SYS.
>
> -scott
> OSR
> @OSRDrivers
>
> ---
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
>