Writing Windows debugger in Linux

Hi,

I need to write a program like a Windows debugger in Linux. Actually, what
I have to do is obtaining the entry point addresses and the name of
functions in Windows executable files (or executable images captured from
memory) by using their PDB files. In other words:

  • Input : application.exe, application.pdb
    -output: Function names and addresses in application.exe.

I assume all functions in the PE files are not accessible by export table.
Also, I cannot use Windows libraries (i.e., Dia2 or dbghelp).

Thanks in advance,
–JJ

You might be able to use dbghelp under Wine.

If all else fails, CodeView is documented and there’s enough information
out there about PDB that you could at least get the basic information.

Good luck,

Mm

*Sent from my Verizon Wireless 4G LTE DROID*

james johnson wrote:

Hi,

I need to write a program like a Windows debugger in Linux. Actually, what
I have to do is obtaining the entry point addresses and the name of
functions in Windows executable files (or executable images captured from
memory) by using their PDB files. In other words:

- Input : application.exe, application.pdb
-output: Function names and addresses in application.exe.

I assume all functions in the PE files are not accessible by export table.
Also, I cannot use Windows libraries (i.e., Dia2 or dbghelp).

Thanks in advance,
–JJ
— WINDBG is sponsored by OSR OSR is hiring!! Info at
http://www.osr.com/careers For our schedule of WDF, WDM, debugging and
other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

CodeView is one old symbolic file format, quite different than the PDB, am
I right?

2013/12/31 MARTIN OBRIEN

> You might be able to use dbghelp under Wine.
>
> If all else fails, CodeView is documented and there’s enough information
> out there about PDB that you could at least get the basic information.
>
>
> Good luck,
>
> Mm
>
> Sent from my Verizon Wireless 4G LTE DROID
>
>
> james johnson wrote:
>
> Hi,
>
> I need to write a program like a Windows debugger in Linux. Actually, what
> I have to do is obtaining the entry point addresses and the name of
> functions in Windows executable files (or executable images captured from
> memory) by using their PDB files. In other words:
>
> - Input : application.exe, application.pdb
> -output: Function names and addresses in application.exe.
>
> I assume all functions in the PE files are not accessible by export table.
> Also, I cannot use Windows libraries (i.e., Dia2 or dbghelp).
>
>
> Thanks in advance,
> --JJ
> — WINDBG is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of WDF, WDM, debugging and
> other seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer — WINDBG is sponsored
> by OSR OSR is hiring!! Info at http://www.osr.com/careers For our
> schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


--------------------------------------
Best Regards!
Moore.Zhang (Zhang Pei)

Its descendent is still used inside of a pdb - type information et c. CV7,
IIRC.

The pdb is a wrapper around the symbol information, with “tables” for
things like publics and so forth.

If you look at the DIA headers and dia2dump source code (comes with visual
studio), you can sort of see how it is roughly arranged (“streams” in dia
terminology). Not really/fully, but it’s a place to start.

Also useful is the source for dbh.exe which comes with the platform SDK.

As far as the actual pdb format, that’s not documented, but the information
is all out there, based on my encounter with needing to do this in a
nonstandard environment maybe six years ago.

The Sven Schreiber book also has some dated information on this.

But to recap, certainly if dbghelp runs under Wine (I’m betting it does),
that would be the way to go, IMO.

Not sure what dia2dump requires in the way of windows libraries, but I’m
pretty sure dbghelp help is not among them. If so, it might be easier to
modify it and then run under Wine.

Or not. Never tried.

Good luck,

Mm

*Sent from my Verizon Wireless 4G LTE DROID*

Moore Zhang wrote:

CodeView is one old symbolic file format, quite different than the PDB, am
I right?

2013/12/31 MARTIN OBRIEN

> You might be able to use dbghelp under Wine.
>
> If all else fails, CodeView is documented and there’s enough information
> out there about PDB that you could at least get the basic information.
>
>
> Good luck,
>
> Mm
>
> Sent from my Verizon Wireless 4G LTE DROID
>
>
> james johnson wrote:
>
> Hi,
>
> I need to write a program like a Windows debugger in Linux. Actually, what
> I have to do is obtaining the entry point addresses and the name of
> functions in Windows executable files (or executable images captured from
> memory) by using their PDB files. In other words:
>
> - Input : application.exe, application.pdb
> -output: Function names and addresses in application.exe.
>
> I assume all functions in the PE files are not accessible by export table.
> Also, I cannot use Windows libraries (i.e., Dia2 or dbghelp).
>
>
> Thanks in advance,
> --JJ
> — WINDBG is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of WDF, WDM, debugging and
> other seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer — WINDBG is sponsored
> by OSR OSR is hiring!! Info at http://www.osr.com/careers For our
> schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars To unsubscribe, visit the List Server section
> of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


--------------------------------------
Best Regards!
Moore.Zhang (Zhang Pei)
— WINDBG is sponsored by OSR OSR is hiring!! Info at
http://www.osr.com/careers For our schedule of WDF, WDM, debugging and
other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer