[ArkPhaze]

You'll need Windows Debugging Tools for this from Microsoft.

Specifically dbh.exe, but I would also require you to get curl too.

First off we load the file into dbh and use the info command. Here's my example (I have DBH loaded into my environment variables):

Code:

dbh Program.exe

Code:

Program [1000000]: info

Now we get a range of information, but you'll want to pay attention to:
• PdbSig
• PdbSig70
• PdbAge

Here's my output for a program of my own just to show you:

Code:

PS C:\Users\Infinity\Desktop> dbh Program.exe Program [1000000]: info SizeOfStruct : 0x688 BaseOfImage : 0x1677721664x ImageSize : 0x1000000 TimeDateStamp : 0x4ed235c3 CheckSum : 0x0 NumSyms : 0x0 SymType : SymPdb ModuleName : Program ImageName : Program.exe LoadedImageName : C:\Users\Infinity\Desktop\Program.exe LoadedPdbName : C:\Users\Infinity\documents\visual studio 2010\Projects\WindowsApplication18\Wind owsApplication18\obj\x86\Debug\WindowsApplication18.pdb CVSig : 0x53445352 CVData : C:\Users\Infinity\documents\visual studio 2010\Projects\WindowsApplication18\Wind owsApplication18\obj\x86\Debug\WindowsApplication18.pdb PdbSig : 0x0 PdbSig70 : 0xebabef1b, 0x08ab, 0x4fc2, 0x9d, 0xc0, 0x80, 0xfe, 0xec, 0xef, 0xc4, 0x6b PdbAge : 0x1 PdbUnmatched : false DbgUnmatched : false LineNumbers : true GlobalSymbols : true TypeInfo : false SourceIndexed : false PublicSymbols : true

PdbSig70 : 0xebabef1b, 0x08ab, 0x4fc2, 0x9d, 0xc0, 0x80, 0xfe, 0xec, 0xef, 0xc4, 0x6b

Mash those numbers together and we get:

Code:

ebabef1b08ab4fc29dc080feecefc46b

Now here comes in the purpose of curl for downloading the PDB:

From my example we use that mashed alphanumeric value and input it into a url like so:

Code:

curl --user-agent "Microsoft-Symbol-Server" http://msdl.microsoft.com/download/symbols/Program.pdb/ebabef1b08ab4fc29dc080feecefc46b/Program.pd_ --output Program.pd_

Since we can't download the PDB directly, we utilize Microsofts Symbol Server user agent to get it for us through curl, and voila!

I just used an example program of my own, but to get pdb's from Microsoft, it should be common sense that they have to be programs default with Windows...