-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Error Importing File When Using PDB/XDB File #27
Comments
well without your files I can not debug that and all I can say it works with my test files. the only thing that changed recently is ghidra's pdb reader interface, maybe that causes problems |
I uploaded it to google drive since it was too big for github: https://drive.google.com/file/d/1Kz4hVMz67_0gFM5zERj1VEYNYaIVGabJ/view?usp=sharing Lemme know when you have them, I want delete them from google drive. Google is a pain about stuff like this Also, Using ghidra 11.1.1 I did decompile the pdb with the dia tool in visual studio and, adjusting for the starting offsets, the functions seem to match the function calls in the pdb. So I'm not quite sure what has angered the importer but sadly I dunno how ghidra pdb works. Apparently there are structure definitions in there too which is new for me. I'm only used to function signatures |
well I cant directly download it, but it showed a button to request access from you, pls check your emails PS: please keep in mind im very busy usually so fixing this can take a while, I hope you are patient |
Strange, it should of worked for anyone with link. I updated it again. And you're fine, I appreciate what you have done already. Ultimately I don't need anything immediately, this was more of a curiosity anyway, but it may help others in the future. I completely understand and have no expectations for you to rush it or anything |
alright, it worked this time and I got the files. I will let you know once I know more |
btw, I havent forgotten about this, a first quick debug session reveals its a problem in loading/applying types, not loading the pdb itself. The default pdb loader ignores alot stuff, so Ive been testing with the experimental one (the one I wrote). Also check out the latest release with the new ghidra, it now has a pdb loading dialog, in there it will complain that the pdb doesnt match but you can still load it. I will let you know once I know more. |
TPIStream.txt Im sorry but im out of time, so I will have to make a new release next weekend... Greetz WV |
It works! Thank you. I don't want to seem ungrateful, I understand you're busy; however, I do notice that it appears to struggle with anonymous structs and unions. Here is an example from the decomp. Type: guard_state_data
this game REALLY likes to use anonymous structs, especially when wrapped in anonymous unions. (I'm pretty sure) The field "guard_firing_position_index" is a union with "guard_point" (at offset 0x28) the PDB parser makes these sequential instead. I think it might not parse this as a union because it's an inline anonymous union instead of using a defined union type (kinda like the guard direction above at offset 0x18) This is what we got from IDA (I don't have IDA, but my friend who dissassembled it with IDA sent me a header file with all the structs in it)
Another issue is since it's an I can just delete all the unnamed tags and manually enter it in. Having a lot of it defined still does save me a lot of time still from what I was doing; so, I don't want to seem ungrateful. If I knew how java worked I would consider just trying to do it myself. Also, I dunno if it would be possible, but it seems like the function parameters are available in the PDB as well. For example: the parser parsed a function as: But the decompiled PDB shows function parameters (strangely enough local parameters sometimes too, but I don't think that would be doable)
Which when manually entered would supply me with the following function signature: I would 100% be willing to try and contribute to the project if I knew how. I've never built a ghidra plugin, and I don't have much experience with java. I do have a bunch of experience with reverse engineering binary data formats though, and if there is a way I can maybe help locate where the data in in the PDB so it can be parsed; I would be quite happy to try and help with that. I hate just asking you to do something for me, and not offering anything in return :c I am extremely appreciative of what you have done already These are things I can 100% work around on my own with some work, and if this doesn't seem manageable I understand completely. Though, it may be beneficial to other people in the future who might use the plugin who have PDBs with this much info in em. Again, thank you for what you have done to help me. I really appreciate it c: |
Hi, https://github.com/Microsoft/microsoft-pdb/blob/master/cvdump/cvdump.exe then run which will create a ca. 500MB text file, which shows in detail how the types are structured. now I have to compare my code that reads that with that output: if you can help me figure out HOW that structure is read wrong, we can maybe solve this together :) but currently I really dont know and dont have enough time to waste a day on comparing my output with that from m$. btw, also disable the "process .pdata section" if you load a pdb with my tool, because that would create these func_xxxxxxxx names, which should exist the pdb with the real name, so we dont need them. greetz WV PS: here your function in the output from m$:
|
I appreciate the reply c: I may have actually...rewritten pretty much all the pdb parser already. I have most of the TPI types (except for the 16 bit versions) parsed. I created a common interface and I'm working on converting the parsed type strings into ghidra data types. I have the same problem though of short time so I work on it when I can, I have been using the dia dumb application that comes with visual studio for cross referencing. I have an idea for naming conflicts to just use a generated UUID. After that I want to get symbols parsed too, such as globals, and I want to construct classes from the class methods and data. Was kinda hard to find documentation on this, I had to use Microsoft's PDB GitHub (and my god does Microsoft have terrible naming conventions) page and a PDF from like 2001. So, if I am able to finish this, and you're open to contribution I can share it at some point. No guarantee 😔 but I'll try. If not, I'll just use it for my own project needs. It'll just need some testing on more PDBs than the one I have |
I am trying to use the plugin to load a game that has a PDB & XDB file bundled with it; however, when I try to load the file with the PDB it complains about the file not being able to be opened. The PDB works in IDA for my friend. but it won't work in ghidra. Though, when try to decompile the xex it works no problem, it's only when I use the PDB that it complains that the file cannot be opened.
This is the trace:
I followed the directions, disabled pdata, set load PDB and set use experimental. When using the PDB it complains that it doesn't match the xex, but when I use the XDB it says that it matches correctly. It crashes at the VERY end of parsing the types.
The text was updated successfully, but these errors were encountered: