pdb2json - query for known timedatestamp & size from name or pdb guid?

[Zhentar]

Sometimes, when I'm interested in analyzing a file, the version I currently happen to have on hand won't have public symbols available, while other versions do (e.g. Windows Defender executables). If you know the right timedatestamp & size, you can just download the binary from the symbol server, but that's not necessarily an easy thing to find (even if you already have the PDB!). It would be great to be able to query for a filename and get back a list of versions with symbols available on the MS symbol store - and it seems like pdb2json's database should have everything needed to provide that. Is it possible?

[K2]

Sorry I missed this somehow. dt.sh uses llvm-readobj to get this information out (also extracts the GUID).
I don't think it would be that hard to brute force this information. Since you have a starting point in a file you currently want to lookup, some.dll. You could extract (like with dt.sh) the details for that binary then, since the size is page aligned, you only have to start rolling the date with each request. Maybe do 3 requests per day since the size +- 1 page and that would probably work.

[K2]

Btw, neat PS debugger. I would love to see it on PS6+ I wrote some Linux code that uses the json symbols in inVtero.Core Something similar may help you have remote debug targets or read/write strongly-typed symbols like I did with IP. The HashServer repository has some code that is basically what I have in Azure, I had not released some of the interfaces you mentioned since I didn't know if/how/what sort of legal issues there might be with allowing binary downloads.

[Zhentar]

Yeah, I have been considering the brute force approach, but unfortunately it won't work for Windows 10 symbols (since they use reproducible build hashes rather than actual timestamps). And definitely I agree with the legal concerns of hosting the binaries directly, which is why I just want an index to ask Microsoft for them directly :)