Rantanen / ghidra-minidump-loader

Windows Minidump loader for Ghidra

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support PDBs

Rantanen opened this issue · comments

Initial start in the 'pdb' branch. Seems using most of Ghidra's PDB implementation should work. All we seemingly need to do is have the user specify the PDB file and then matching it to a proper PE image offset. Once that's done, the rest of the load seems to work okay with Ghidra's own stuff.

The current plan is:

  • Implement a Modules list that displays all modules and their PDB status (very similar to VS Modules view).
  • The list also acts as a navigation to the modules themselves in the listing, which means the view knows the base addresses.
  • Allow loading PDBs through that list.
    • This attempts to find the PDB from the file path in the PE image (we could just as well do that since it's just a quick file check).
    • If the file isn't found, pop up a file chooser and have the user select the PDB.
    • All of this could be automated through the PdbLocator maybe?
    • Once we have path to (GUID/Signature verified) PDB, we feed that to Ghidra together with our module base address and have it do the rest.
  • Next step would be to figure out the symbol server APIs to have symbols loaded automatically for compatible modules.
  • Finally having all of this as part of code analysis and/or being able to tell Ghidra to not ask for code analysis would be great since we'll ideally want the PDBs loaded first before code analysis goes off.
    • Since we need to ask the user for PDBs in some cases, having this as part of code analysis might not be feasible.

Done as a "Module PDB Loader" analyzer.