Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Why locals/arguments names and types retrieval from private PDBs could be useful?
- Occasionally there are private symbols available for some binaries. So not only function names are available, but also function return types, and names and types of func arguments and locals.
- Unfortunately, the version of such symbol-rich binaries often doesn't match the version of of binaries one would like to reverse. E.g. there are symbols for decade-old binaries, or binaries of different architecture, or one doesn't have binaries for the private symbols at all.
- So what one can do is extract as much info from these mismatching private PDB files as possible and apply it to the current, actual binaries. Structure extraction from PDB is well-established. But function info is not.
- Currently to extract func info one can either open old binary in IDA and e.g. produce header; or open binary as dump in Windbg, and exec "dt -v FUNC; dv /i /t /V /f FUNC" for each function, then possible parse output with regex or something. Both options are cumbersome. And if only PDB is available, but not binary, then Windbg is the only option.
- Thus it would be awesome if PDB extraction tool could produce function declarations from PDB, as C header file. With correct argument names and types. Header then could be equally well ingested by other tools or examined manually.
- Since it seems like locals are right near the arguments in the function descriptors in the PDB, it would be nice extra addition to also have local names and types listed, as comments.
- Example of produced declaration (that prototype is well-known, but will do as example):
- ```
- long
- __fastcall // may be drop it? esp. if it's not straightforward to get
- NtRaiseException(
- struct _EXCEPTION_RECORD* ExceptionRecord,
- struct _CONTEXT* ContextRecord,
- uchar FirstChance
- );
- // long Status
- // struct _KEXCEPTION_FRAME ExceptionFrame
- ^ two locals as comments
- ```
- A few things to note:
- 1. Struct refs are declared in full form (with "struct"), as to avoid requiring structure definitions.
- 2. No attempt is made to show location of local vars "Status" and "ExceptionFrame", they are just listed as comments. Location is not very actionable, as it is too volatile in different binaries.
- 3. Still, if static vars are handled like locals (I'm not sure), there might be need to add extra comment/mark for the statics.
- 4. No attempt is made to show location of arguments. They are sometimes transfered in "unexpected" registers, such as EDI or R10, and PDBs have that info, but I think such information is too volatile. May be at user discretion __usercall convention could be produced with correct regs, but I tend to think it mostly won't be needed.
- And that's it!
Advertisement
Add Comment
Please, Sign In to add comment