驱动中解析pe文件的pdb,一切尽在代码中,本博客不负责科普,能立即用的代码你都有了,头文件、结构体、注释都整理好你还想要啥?
CreateMapFileAndGetBaseAddr()的定义就看我下一篇文章。
#include <ntifs.h>
#include <windef.h>
#include "ntimage.h"
#define NB10_SIG '01BN'
#define RSDS_SIG 'SDSR'
typedef struct CV_HEADER
{
DWORD Signature;
DWORD Offset;
}CV_HEADER;
typedef struct CV_INFO_PDB20
{
CV_HEADER CvHeader;
DWORD Signature;
DWORD Age;
BYTE PdbFileName[1];
}CV_INFO_PDB20;
typedef struct CV_INFO_PDB70
{
DWORD CvSignature;
GUID Signature;
DWORD Age;
BYTE PdbFileName[1];
}CV_INFO_PDB70;
BOOL PeIsRegionValid(PVOID Base, DWORD Size, PVOID Addr, DWORD RegionSize)
{
return ((PBYTE)Addr >= (PBYTE)Base && ((PBYTE)Addr + RegionSize) <= ((PBYTE)Base + Size));
}
//返回TRUE 但PdbStr为空意思是找过了确实没有PDB
BOOLEAN PeGetPdb(PVOID ImageBase, DWORD ImageSize, PCHAR PdbStr)
{
PBYTE Base =