Prompt to open debug file prior to analysis if it might exist

Open
#2,550 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
reverse-engineering

Research direction

The issue names no files or tests. Start by tracing the PE debug-directory and PDB-loading flow alongside the open and analysis-hold flow; determine whether equivalent metadata exists for ELF or Mach-O. Done means a detected debug-file path prompts before analysis and lets the user provide the PDB.

Written by the indexing model from the issue text.

Description

Component: DebugInfo DebugInfo: PDB Effort: Low Impact: Low

Is your feature request related to a problem? Please describe.

Loading PE with PDBs properly is too many clicks. Open with options, analysis hold, load pdb, remove analysis hold.

Describe the solution you'd like
When opening a PE, one of the debug directories in the PE header contains the pdb path. Binja should apply an analysis hold and ask if the user is interested in providing a PDB before loading. Im unsure if this exists for ELF or Mach-O, if so the same behavior would be preferable here.

Describe alternatives you've considered
None really

Additional context
This is IDA's default behavior

You can see and dump the existence of these paths with:

C:\Users\x\Desktop>link -dump -headers quux.exe
...
SECTION HEADER #2
  .rdata name
   15166 virtual size
   6D000 virtual address (000000014006D000 to 0000000140082165)
   15200 size of raw data
   6B600 file pointer to raw data (0006B600 to 000807FF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only

  Debug Directories

        Time Type        Size      RVA  Pointer
    -------- ------- -------- -------- --------
    60ED531A cv            34 0007B62C    79C2C    Format: RSDS, {368BE35F-7672-431F-AF66-96E6F5EC610E}, 2, C:\Users\x\Desktop\quux.pdb // XXX PATH HERE
    60ED531A feat          14 0007B660    79C60    Counts: Pre-VC++ 11.00=0, C/C++=203, /GS=203, /sdl=0, guardN=202
...
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.