Using Microsoft Program Database (PDB) Files

A program database (PDB) file holds debugging and project state information about a program and can be created in a number of ways. Historically, it has been created using a Microsoft compiler and written in C/C++, C#, and Visual Basic. A user generates a PDB file using the /ZI or /Zi flag (for C/C++ programs) or the /debug flag (for Visual Basic/C# programs).

There are two mechanisms for processing a PDB file. First, the platform-independent PDB Universal Reader/Analyzer, which can read a raw PDB file and apply it. Its capabilities are expected to be expanded in future releases. Second, the legacy capability that uses the DIA SDK to read information from the PDB file. This mechanism can only run on a Windows platform, however it creates an XML representation of information gleaned using the DIA SDK. These XML files can be saved and then used on Windows and non-Windows platforms hosting Ghidra.

If loading a PDB, this should be done prior to other analysis, except in special cases, such as when only loading data types.

Restricted loading of data types or public symbols is supported by PDB Universal.

To Load a PDB

PDB files can be loaded in two ways:

File → Load PDB File

PDB Analyzer via Analysis → Auto Analyze or Analysis → One Shot.

Information Loaded From PDB

Structure and union definitions

Typedefs

Enumerations

Class definitions

Function prototypes

Stack variable names and data types

Source line numbers

Instruction and data symbols

The DIA SDK-Based Capability

*.PDB.XML files can be created in three different ways:

From the Ghidra GUI in Windows, use the Ghidra Script Manager to run the CreatePdbXmlFilesScript.java script. Follow the prompts to choose the .PDB file (or directory containing .PDB file(s)) to be converted to .PDB.XML form. When given a directory, the script recursively traverses all subfolders to find .PDB files. A created .PDB.XML file is placed in the same location as the corresponding original .PDB file.

From a Windows command line, navigate to the following directory: <ghidra install root>/support and run the createPdbXmlFiles.bat script. The script takes one argument representing either one .PDB file or a directory of .PDB files. When given a directory, the script recursively traverses all subdirectories to find .PDB files. A created .PDB.XML file is placed in the same location as the corresponding original .PDB file. Sample calls to the script are shown below.

    createPdbXmlFiles.bat C:\Symbols\samplePdb.pdb
    createPdbXmlFiles.bat C:\Symbols

Run the included pdb.exe executable (found in the <ghidra install root>/Ghidra/Features/PDB/os/win64 directory) and redirect (save) its output to an XML file as shown below:

    pdb.exe samplePdb.pdb > samplePdb.pdb.xml

NOTE: Execution of pdb.exe has runtime dependencies which must be satisfied. Please refer to the README_PDB document for details.

Debug Interface Access SDK

The Microsoft Debug Interface Access Software Development Kit (DIA SDK) provides access to debug information stored in program database (.PDB) files generated by Microsoft post-compiler tools. Because the format of the .PDB file generated by the post-compiler tools undergoes constant revision, exposing the format is impractical. Using the DIA API, you can develop applications that search for and browse debug information stored in a .PDB file. Such applications could, for example, report stack trace-back information and analyze performance data.

If you are attempting to load a PDB on a Windows machine and see an error message such as "Unable to locate the DIA SDK," you will need to add and register one or more files on your computer. Refer to the README_PDB document for detailed instructions.