Search code examples
windowspdb-files

Does PDB file contain data structures?

I'm reading this document, it says PDB contains type data. Does it mean it contains C structure information?

I couldn't find such thing in https://github.com/microsoft/microsoft-pdb. It seems like only the type name is available, but no C structure or C++ class definition.

Am I wrong?

Solution

  • Yes, type information can be included in PDBs. The WinDbg command to display types is dt. Microsoft provides some of their type definitions for download if you use .symfix. Since ntdll is loaded into every process, it's quite simple to demonstrate.

    A simple example is a list entry of a doubly linked list, consisting of a forward and backward link:

    1:001> dt nt!_LIST_ENTRY
ntdll!_LIST_ENTRY
   +0x000 Flink            : Ptr64 _LIST_ENTRY
   +0x008 Blink            : Ptr64 _LIST_ENTRY

    or a Unicode string:

    1:001> dt _UNICODE_STRING
ntdll!_UNICODE_STRING
   +0x000 Length           : Uint2B
   +0x002 MaximumLength    : Uint2B
   +0x008 Buffer           : Ptr64 Wchar

    or a critical section:

    1:001> dt _RTL_CRITICAL_SECTION
ntdll!_RTL_CRITICAL_SECTION
   +0x000 DebugInfo        : Ptr64 _RTL_CRITICAL_SECTION_DEBUG
   +0x008 LockCount        : Int4B
   +0x00c RecursionCount   : Int4B
   +0x010 OwningThread     : Ptr64 Void
   +0x018 LockSemaphore    : Ptr64 Void
   +0x020 SpinCount        : Uint8B