Tuesday, February 12, 2008

Exploring what pdbstr.exe actually does

As I wait to find out what else I can do to get the symbolstore.py patch commit-worthy, I thought I would start to look into reading and writing to pdbs as described here.

I downloaded Paws.exe which is a hex editor program and also installed Borland's C++ compiler so I could try to dump the contents of a pdb with Borland's tdump utility.

This netted me a whole lot of hex code and so I stared at that for a while, consulting Jeremy Gordon's information, and didn't really figure much out. I can see the data block that pdbstr write to the file, it's just not clear after comparing the dump information of a couple of pdbs how or where the data block's write position is determined. This is a hex dump.

For kicks my friend John Ford and I looked at pdbstr.exe through strace and Wine on his Ubuntu box. The results are here.

There is a StraceNT for Windows so I will try to run pdbstr with that and hopefully end up with results that are a bit clearer since they won't include the Wine calls.

Anyone with any ability to read into either of these dumps - feel free to comment and share your insights.

No comments: