zouxianyu/query-pdb

query-pdb is a server-side software for parsing PDB files. The software provides PDB online parsing service.

Homepage

kanxue: https://bbs.pediy.com/user-home-749612.htm

UnknownCheats: https://www.unknowncheats.me/forum/members/1934883.html

Contact

Telegram: (at) hlw2014

Projects

Game Security

Operating System

CS Homework

query-pdb's Issues

Handle mangled and decorated names

It seems like it could be a nice feature to demangle/de-decorate names from pdbs. For example in this pdb:

https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/00625D7D36754CBEBA4533BA9A0F3FE22/ntkrnlmp.pdb

Query:

{'name': 'ntkrnlmp.pdb', 'guid': '00625D7D36754CBEBA4533BA9A0F3FE2', 'age': 2, 'query': ['ExAllocatePoolWithTag']}

Result:

'{"ExAllocatePoolWithTag":-1}'

But this query resolves:

{'name': 'ntkrnlmp.pdb', 'guid': '00625D7D36754CBEBA4533BA9A0F3FE2', 'age': 2, 'query': ['_ExAllocatePoolWithTag@12']}

Result:

'{"_ExAllocatePoolWithTag@12":1146886}'

This could be a nice feature/enhancement. Could be a change in this repo or MolecularMatters/raw_pdb

support raw TCP request

http and json are difficult to use in kernel mode. raw TCP request is friendly to kernel mode.

support symbols retrieval from special address

the function is like what "SymFromAddr" do

Add flag to indicate not found instead of using -1

ideas from @orange088

add windows driver request demo