How to load PDB which have different time stamp

Sometimes it happens that you forget to store the PDB of your application and give executable to your customers. Once you received any crash dump for your application, you might realize that PDBs are missing and WinDBG is not loading them now.

What you can do now ??

Well..you still have the source code ... you can build it again and get the 'logically correct' PDBs ... but unfortunately, our debugger does not understand this because it will look for timestamps and other checksum. Though loading new PDB is not logically wrong because it also point to exact same source ... but we need to tell this to our debugger.

Steps are here  :

If you are in such a situation, please use this command series:

.symopt+ 0x40

.reload

in case if you are trying to load symbols which are in deferred state use  .reload /f

How to write a Basic Windows Driver

Its very simple. You just need to create three files.

sources [No extension please]


TARGETNAME = driver
TARGETPATH = obj
TARGETTYPE = DRIVER
INCLUDES   = %BUILD%\inc
LIBS       = %BUILD%\lib
SOURCES    = driver.c

makefile [No extension please]

!INCLUDE $(NTMAKEENV)\makefile.def

Driver.c [You can choose any name, it should just match with 'sources' file entry]


#include <ntddk.h>


VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
    DbgPrint("Driver unloading\n");
}


NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) 
{
    DbgPrint("Hello, World\n");
DriverObject->DriverUnload = DriverUnload;


    return STATUS_SUCCESS; 
}

How to compile ?? 

Just install DDK

use Build env and choose the specific platform

go to directory where you have all these above 3 files.

run build command. That's It. You must get your SYS. Look around :)

Now, how to Load/Test ?

Simple, we will use Windows Service manager for it (as of now)

open command prompt (i am doing this on Windows XP)

run sc create driver binPath= c:\driver.sys type= kernel

[here the driver is the driver name (you can choose any name) and i have pasted my SYS file in C driver. Choose the path where your SYS file is]

That's it Done. ;)

How to Load this driver? 

Now open the command prompt and run command net start driver 

[here driver is my driver name, you can choose your name]

That's it. If you are running DebugView, you can see "hello, world" in your view.

How to unload this driver?

Just run net stop driver

[here, driver is my driver name, you can choose any name]

That;s it. If you are running DebugView, you can see 'driver unloading' statement in your view.

Is not that simple !!   :)