驱动中解析pe文件之pdb

驱动中解析pe文件的pdb，一切尽在代码中，本博客不负责科普，能立即用的代码你都有了，头文件、结构体、注释都整理好你还想要啥？

CreateMapFileAndGetBaseAddr()的定义就看我下一篇文章。

 

 

#include <ntifs.h>
#include <windef.h>
#include "ntimage.h"

#define NB10_SIG	'01BN'
#define RSDS_SIG	'SDSR'
typedef struct  CV_HEADER
{
	DWORD Signature;
	DWORD Offset;
}CV_HEADER;

typedef struct CV_INFO_PDB20
{
	CV_HEADER	CvHeader;
	DWORD		Signature;
	DWORD		Age;
	BYTE		PdbFileName[1];
}CV_INFO_PDB20;
typedef struct CV_INFO_PDB70
{
	DWORD	CvSignature;
	GUID	Signature;
	DWORD	Age;
	BYTE	PdbFileName[1];
}CV_INFO_PDB70;

BOOL PeIsRegionValid(PVOID Base, DWORD Size, PVOID Addr, DWORD RegionSize)
{
	return ((PBYTE)Addr >= (PBYTE)Base && ((PBYTE)Addr + RegionSize) <= ((PBYTE)Base + Size));
}

//返回TRUE 但PdbStr为空意思是找过了确实没有PDB
BOOLEAN PeGetPdb(PVOID ImageBase, DWORD ImageSize, PCHAR PdbStr)
{
	PBYTE Base =