codeview-rsds.cpp File Reference

Bounded in-memory CodeView RSDS parser. More...

#include "pch.h"

Functions
BOOLEAN	SymExtractCodeViewRsdsInfoFromPeImage (const BYTE *ImageBase, SIZE_T ImageSize, CHAR *PdbFileName, SIZE_T PdbFileNameSize, GUID *Guid, DWORD *Age)
	Extracts CodeView RSDS information from a PE image in memory, interpreting the image as it would be laid out on disk.
BOOLEAN	SymExtractCodeViewRsdsInfoFromLoadedPeImage (const BYTE *ImageBase, SIZE_T ImageSize, CHAR *PdbFileName, SIZE_T PdbFileNameSize, GUID *Guid, DWORD *Age)
	Extracts CodeView RSDS information from a PE image in memory, interpreting the image as it would be laid out in memory when loaded (i.e., using loaded image offsets).

Detailed Description

Bounded in-memory CodeView RSDS parser.

Author

jtaw5649

Version

0.19

Date

2026-06-02

Copyright

This project is released under the GNU Public License v3.

Function Documentation

SymExtractCodeViewRsdsInfoFromLoadedPeImage()

BOOLEAN SymExtractCodeViewRsdsInfoFromLoadedPeImage	(	const BYTE *	ImageBase,
		SIZE_T	ImageSize,
		CHAR *	PdbFileName,
		SIZE_T	PdbFileNameSize,
		GUID *	Guid,
		DWORD *	Age )

Extracts CodeView RSDS information from a PE image in memory, interpreting the image as it would be laid out in memory when loaded (i.e., using loaded image offsets).

Parameters

ImageBase	The base address of the PE image in memory
ImageSize	The size of the PE image in bytes
PdbFileName	An output buffer to receive the base name of the PDB file extracted from the CodeView data. Must be at least PdbFileNameSize bytes
PdbFileNameSize	The size of the PdbFileName buffer in bytes
Guid	An output pointer to receive the GUID extracted from the CodeView data
Age	An output pointer to receive the age extracted from the CodeView data

Returns

BOOLEAN TRUE if the CodeView RSDS information was successfully extracted, FALSE otherwise (e.g., if image is invalid or does not contain valid RSDS information)

{
    return SymExtractCodeViewRsdsInfoFromPeImageInternal(ImageBase, ImageSize, PdbFileName, PdbFileNameSize, Guid, Age, TRUE);
}

SymExtractCodeViewRsdsInfoFromPeImage()

BOOLEAN SymExtractCodeViewRsdsInfoFromPeImage	(	const BYTE *	ImageBase,
		SIZE_T	ImageSize,
		CHAR *	PdbFileName,
		SIZE_T	PdbFileNameSize,
		GUID *	Guid,
		DWORD *	Age )

Extracts CodeView RSDS information from a PE image in memory, interpreting the image as it would be laid out on disk.

Parameters

ImageBase	The base address of the PE image in memory
ImageSize	The size of the PE image in bytes
PdbFileName	An output buffer to receive the base name of the PDB file extracted from the CodeView data. Must be at least PdbFileNameSize bytes
PdbFileNameSize	The size of the PdbFileName buffer in bytes
Guid	An output pointer to receive the GUID extracted from the CodeView data
Age	An output pointer to receive the age extracted from the CodeView data

Returns

BOOLEAN TRUE if the CodeView RSDS information was successfully extracted, FALSE otherwise (e.g., if image is invalid or does not contain valid RSDS information)

{
    return SymExtractCodeViewRsdsInfoFromPeImageInternal(ImageBase, ImageSize, PdbFileName, PdbFileNameSize, Guid, Age, FALSE);
}