当前位置:网站首页>Viewing PDB files from the angle of assembly

Viewing PDB files from the angle of assembly

2020-11-09 12:25:00 Several sunsets have turned red

Let's start with an assembly code

; AddVariables.asm - Chapter 3 example.

.386
.model flat,stdcall
.stack 4096
ExitProcess proto,dwExitCode:dword

.data
firstval  dword 20002000h
secondval dword 11111111h
thirdval  dword 22222222h
sum dword 0

.code
main proc
    mov   eax,firstval                
    add   eax,secondval        
    add   eax,thirdval
    mov   sum,eax

    invoke ExitProcess,0
main endp
end main

The purpose of this code is to declare several variables , Then add up the values of each variable , And finally put it in a new variable . such as firstval dword 20002000h,firstval Represents the variable name ,dword The data type represented is unsigned long,20002000h Represents a hexadecimal number .

One 、 Before the program runs , The value of each variable and the value of the register

Two 、 The program runs out , The value of each variable and the value of the register

3、 ... and 、 Translate it into exe

Now I use Debug Pattern compiler , When it's over, it will generate a exe Document and pdb Commissioning documents , Here's the picture .

The key is coming. , Now I use IDA, To reverse Project.exe Program .
Drag the file into IDA after , You will be prompted whether to load pdb file , I choose Yes.

Take a look at IDA The result of disassembly , As like as two peas, the variable name and method name are identical .

 

Now I'll test , If IDA No load pdb Word of the file , What will happen .

You can see that the code method name and variable name are missing , This is it. pdb The meaning of convenient debugging .

 

版权声明
本文为[Several sunsets have turned red]所创,转载请带上原文链接,感谢