m4b / m4b/goblin

Expose PDB70 signature as a UUID? (Disposition: Yes)

Open
#79 14 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted
Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

I wrote some code to read the PDB70 info out of a PE using goblin, to implement the equivalent of `symstore.exe`. I found that [`CodeviewPDB70DebugInfo::signature`](https://github.com/m4b/goblin/blob/a293c5041437367d564e2e7f7c06b63ff1b4a76b/src/pe/debug.rs#L75) wasn't really that useful as raw bytes, since it's intended to be a `GUID` in little-endian byte order. I wound up pulling in `byteorder` and writing a little function like:
```rust
fn sig_to_uuid(sig: &[u8; 16]) -> Result {
let mut rdr = Cursor::new(sig);
Ok(Uuid::from_fields(rdr.read_u32::()?,
rdr.read_u16::()?,
rdr.read_u16::()?,
&sig[8..])?)
}
```

...but it seems likely that anyone touching this data would need the same thing. Since you're already using `scroll` here it ought to be trivial to do this. I don't think the `uuid` crate is a particularly big dependency (and it's no-std by default, you have to enable the `use_std` feature explicitly).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/pe/debug.rs at CodeviewPDB70DebugInfo::signature and inspect how PDB70 data is parsed and exposed. Evaluate the proposed uuid dependency and API, then verify that the signature is available as a UUID while preserving the existing PE parsing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.