mirror of
https://github.com/wavestone-cdt/EDRSandblast.git
synced 2026-06-10 17:31:23 +00:00
Implements a check on PDB files to avoid using an invalid one and crash the machine
When loading a PDB that was already on disk (not downloaded) for a specific PE, verifies that the PDB file is indeed for the current version of the target PE. (Did I just started to write a PDB file parser ?)
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
#pragma once
|
||||
#include <Windows.h>
|
||||
|
||||
PVOID extractGuidFromPdb(LPWSTR filepath);
|
||||
@@ -1,4 +1,5 @@
|
||||
#pragma once
|
||||
#include "PEParser.h"
|
||||
|
||||
typedef struct symbol_ctx_t {
|
||||
LPWSTR pdb_name_w;
|
||||
@@ -6,6 +7,7 @@ typedef struct symbol_ctx_t {
|
||||
HANDLE sym_handle;
|
||||
} symbol_ctx;
|
||||
|
||||
symbol_ctx* LoadSymbolsFromPE(PE* pe);
|
||||
symbol_ctx* LoadSymbolsFromImageFile(LPCWSTR image_file_path);
|
||||
DWORD64 GetSymbolOffset(symbol_ctx* ctx, LPCSTR symbol_name);
|
||||
DWORD GetFieldOffset(symbol_ctx* ctx, LPCSTR struct_name, LPCWSTR field_name);
|
||||
|
||||
Reference in New Issue
Block a user