editing Debug Information Directory in a PE file

[jonwil]

I have a PE file and a matching PDB file.
Problem is, the PE file was packed and somewhere the packer (or the unpacking process) has removed the debug information directory that points at the PDB file.
Which means that (AFAIK) IDA cant read the PDB file.

Is there a way to add back the debug information directory or to get IDA to load the PDB file without it?

I am sure the PDB file matches because I dumped some symbols from it with pdbdump and I can match them up to ASM in IDA.
But I dont want to have to manually input all these symbols if I dont have to

[ee45678]

I don't think it should be a problem.

To test it I have just compiled a sample program to generate debug symbols and then stripped the executable of all the debug info (saved the PDB file for later use) and fed it to IDA.

And when asked to load the PDB file it complained about not having the dbghelp.dll file in IDA or Windows System directory. I located an appropriate dbghelp.dll file, copyied it to Windows System directory, rebooted just to be safe, then loaded the executable into IDA, and finally asked it to load the PDB file.

It reports as having loaded the symbols OK, reported as having loaded xxx number of symbols. But to be honest I don't see all the symbol names in the listed code :-(

[Thims]

I used dbghelp 4.1+ plugin (with manual PDB loading dialog): it worked flawless in a sutiation like yours.

[gigaman]

Btw, there's a pdbplus plugin for IDA - it extracts more information than the default one.

[ee45678]

Thims, I couldn't locate any IDA plugin with such a name while searching.

What is this dbghelp plugin, are you referreing to PDBPlus (1.9) or is it something else? And if it is something else then where might we find it?
Thanks

[Cobi]

'PDB Plus' is a replacement PDB loader for IDA Pro 4.5 that uses newer versions of DBGHELP.DLL to get all local variable names into an IDA database, in addition to standard function/data names. In future this might be extended to define IDA structures and enumerations based on the data in the .PDB file.. but I need to find time first.

... that uses newer versions of DBGHELP.DLL ...

You can also use PDB Plus.

detours (hxxp://research.microsoft.com/sn/detours/) has some code for adding a section to an exe file. You should be able to modify it to reinsert the debug section pointing to the pdb.