by Alexander Sotirov
Determina PDB plugin for IDA Pro
This is a replacement for the IDA PDB plugin which significantly improves the analysis of Microsoft binaries with public debugging symbols. The algorithm used by the PDB plugin is described in the Reverse Engineering Microsoft Binaries presentation at Recon 2006.
Version 1.0 was released on June 25, 2007. The distribution contains source code under a BSD license and a binary for IDA 5.0 and 5.1.
Compiling from source
To compile the plugin from source, you will need the following:
- GNU make from Cygwin
- Microsoft Visual C++ 2005
- Debugging Tools for Windows 126.96.36.199
- IDA Pro SDK 5.0 or 5.1
Edit the Makefile and set the IDASDK and DBGSDK variables. They need to point to the directories containing the IDA SDK and the Debugging Tools for Windows SDK. Make sure that the compiler is in your path and the INCLUDE and LIB environment variables are set. Run make to compile the plugin.
- Make a backup copy of
pdb.p64in your IDA plugins directory.
plugin/p64/pdb.p64to your IDA plugins directory, overwriting the existing files.
detpdb.cfgto the IDA cfg directory.
- Make sure that you have the latest versions of dbghelp.dll and symsrv.dll in your IDA directory. If they are older than 188.8.131.52, download the Debugging Tools for Windows and replace the files in the IDA directory with the latest versions.
The Determina PDB plugin uses the same method for finding symbol files as
the WinDbg debugger. By default, the plugin will search the current working
directory, followed by the symbol search path specified in the
The search path can also be specified by setting the
DETPDB_SYMBOL_PATH option in the detpdb.cfg configuration
For more information about the format of the symbol path and the environmental variables, see the documentation included in the Debugging Tools for Windows.
When loading a new file linked with debugging information, IDA will invoke the Determina PDB plugin. If the corresponding symbol file is found in the symbol path, the plugin will display the list of all available symbols and their addresses. Press OK to load these symbols into the IDA database, or Cancel to skip the symbol loading.
Once the IDA autoanalysis is finished, check the messages window for any errors or warnings. You will probably see messages similar to:
Name 'const GCObj::`vftable'' at 5A323BC0 is deleted...
These messages indicate that some names were deleted during the final analysis pass. One solution is to disable the 'Make final analysis pass' options before starting the analysis. A better alternative is to run the PDB plugin a second time after the autoanalysis is finished, ensuring that the deleted names are recreated.