How to extract Debug Info about penet

[secana]

Hi @droyad, I'm not quite sure if I understand what data you want to get out of the PE file. Could you elaborate a bit more what you want?

[droyad]

@secana Thanks for having a look. For examlpe when I run the C++ Developer Tool dumpbin with the /headers flag against PEditor.exe (1.0.1.0), I get the following output:

SECTION HEADER #1
   .text name
   5FE1C virtual size
    2000 virtual address (00402000 to 00461E1B)
   60000 size of raw data
     200 file pointer to raw data (00000200 to 000601FF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read

  Debug Directories

        Time Type        Size      RVA  Pointer
    -------- ------- -------- -------- --------
    5BC43050 cv           11C 00061CA8    5FEA8    Format: RSDS, {96F231BD-9207-421C-9EF5-28D2F4DF0B81}, 1, D:\ExternalRepos\PeNet\src\PEditor\obj\Release\PEditor.pdb

I am interested in the last line, specifically the stuff to the right of Format. The start of the line matches up nicely with the Debug Directory information in the File Header/Debug section of PEditor.

Since I first posted and since I've started writing this reply, I figured out that pointer refers to the offset from the start of the file. If look at that location, I can see the data I need. I have no idea why I didn't see this yesterday when I tried the same thing.

So, I guess, my question has now change to: Is there anything in PENet that will help me read this data before I go out and hack it together myself?
If not, would this be something you would be interested in including in your project if I submit a PR?

[secana]

Hi @droyad, thx for the explanation. Unfortunatly there is currently no way to get the "RSDS, {96F231BD-9207-421C-9EF5-28D2F4DF0B81}, 1, D:\ExternalRepos\PeNet\src\PEditor\obj\Release\PEditor.pdb" information from PeNet.

Unfortunately, I'm very short on time a.t.m, so if I have to do it, it will take a few days. If you hack something together, I would be super happy about a PR, because especially the debug file path is really interesting for malware analysis. If you could extract the information, that would be great.

[droyad]

No worries, I'll see what I can scratch together later this week.