NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.23k stars 5.84k forks source link

Import PDB #6686

Closed vitinhonunes closed 1 month ago

vitinhonunes commented 3 months ago

when importing the pdb file from PE, ghidra returns these errors from the attached images

Ghidra Version: ghidra_11.1.1 OS: Windows 10 64x

S12 s23 S1

dev747368 commented 3 months ago

Your first screen shot seems to be when using the "MSDIA" option, and the second is when using the Universal option. (correct me if I'm wrong).

We are trying to phase out the MSDIA option, but the error from your screenshot is due to our MSDIA wrapper refusing to run when there isn't any pdb info embedded in the binary. (which seems to be the case in your binary since the screen shot shows "Missing" for name and uid).

You could try to force it to work by setting some bogus pdb info by running this snippet in a jython window in Ghidra:

ghidra.app.util.bin.format.pdb.PdbInfoDotNet.fromValues("blah", 1, ghidra.app.util.datatype.microsoft.GUID("6B29FC40-CA47-1067-B31D-00DD010662DA")).serializeToOptions( currentProgram.getOptions("Program Information") )

After this when you bring up the Load PDB window it should show those values instead of "Missing".

The second screen shot with the "Needed data is not available" indicates our universal pdb parser is running into unexpected data. That could either be some corruption in the pdb file, some data that we don't support yet, or just a bug.

Can you share your pdb file with us?

vitinhonunes commented 3 months ago

ProjectG.zip PDB file

dev747368 commented 3 months ago

When loading your pdb file, I was able to see a similar I/O error pop up when using 11.0.1, but I'm not seeing that error when running 11.1.1 or more recent. Could you verify your ghidra version number? And possibly try 11.1.2.

Could you see if the "needed data is not available" error also occurs when loading this pdb into a non-matching PE binary? (I used cmd.exe as the binary when loading your pdb file)