A program database (PDB) file holds debugging and project state information about a program
and can be created in a number of ways. Historically, it has been created using a Microsoft
compiler and written in C/C++
, C#
, and Visual Basic
.
A user generates a PDB file using the /ZI or /Zi
flag (for C/C++ programs) or the
/debug
flag (for Visual Basic/C# programs).
There are two mechanisms for processing a PDB file. First, the platform-independent PDB Universal Reader/Analyzer, which can read a raw PDB file and apply it. Its capabilities are expected to be expanded in future releases. Second, the legacy capability that uses the DIA SDK to read information from the PDB file. This mechanism can only run on a Windows platform, however it creates an XML representation of information gleaned using the DIA SDK. These XML files can be saved and then used on Windows and non-Windows platforms hosting Ghidra.
If loading a PDB, this should be done prior to other analysis, except in special cases, such as when only loading data types.
Restricted loading of data types or public symbols is supported by PDB Universal.
- From the menu-bar of a tool, select File
Load PDB File
- In the file chooser, select the PDB file (*.PDB or *.PDB.XML)
- Click the "Select PDB" button
- PDB Universal is automatically used for *.PDB on non-Windows platforms
- PDB MSDIA is used for *.PDB.XML files
When a user chooses a PDB or XML file to load for a program, Ghidra will verify its signature to be valid for the program. At this time, the PDB MSDIA loader cannot be used to force-load a mismatched PDB. To perform a force-load of a PDB file, the user must choose the PDB Universal loader if given the option. Force-loading an mismatched file can have consequences, such as loading incorrect data types and symbols located at the wrong addresses.
PDB files may also be loaded using the PDB Analyzer, which is available through Auto Analysis or as a One Shot Analyzer.
- Structure and union definitions
- Typedefs
- Enumerations
- Class definitions
- Function prototypes
- Stack variable names and data types
- Source line numbers
- Instruction and data symbols
Before the PDB file is loaded into the program, then PDB signature and age are matched against the information stored in the executable. If these values do not match, then the PDB will not be loaded.
Figure 1
*.PDB.XML files can be created in three different ways:
- From the Ghidra GUI in Windows, use the Ghidra Script Manager to run the CreatePdbXmlFilesScript.java script. Follow the prompts to choose the .PDB file (or directory containing .PDB file(s)) to be converted to .PDB.XML form. When given a directory, the script recursively traverses all subfolders to find .PDB files. A created .PDB.XML file is placed in the same location as the corresponding original .PDB file.
- From a Windows command line, navigate to the following directory: <ghidra install root>/support and run the createPdbXmlFiles.bat script. The script takes one argument representing either one .PDB file or a directory of .PDB files. When given a directory, the script recursively traverses all subdirectories to find .PDB files. A created .PDB.XML file is placed in the same location as the corresponding original .PDB file. Sample calls to the script are shown below.
createPdbXmlFiles.bat C:\Symbols\samplePdb.pdb
createPdbXmlFiles.bat C:\Symbols
- Run the included pdb.exe executable (found in the <ghidra install root>/Ghidra/Features/PDB/os/win64 directory) and redirect (save) its output to an XML file as shown below:
pdb.exe samplePdb.pdb > samplePdb.pdb.xml
NOTE: Execution of pdb.exe has runtime dependencies which must be satisfied. Please refer to the README_PDB document for details.
The Microsoft Debug Interface Access Software Development Kit (DIA SDK) provides access to debug information stored in program database (.PDB) files generated by Microsoft post-compiler tools. Because the format of the .PDB file generated by the post-compiler tools undergoes constant revision, exposing the format is impractical. Using the DIA API, you can develop applications that search for and browse debug information stored in a .PDB file. Such applications could, for example, report stack trace-back information and analyze performance data.
If you are attempting to load a PDB on a Windows machine and see an error message such as "Unable to locate the DIA SDK," you will need to add and register one or more files on your computer. Refer to the README_PDB document for detailed instructions.