Question

I am trying to obtain the module GUIDs from the current process by enumerating the loaded modules using EnumerateLoadedModules64 and in the enumeration callback load modules using SymLoadModuleEx and after that getting module information using SymGetModuleInfoW64.

For all modules with an existing PDB this call succeeds and the PdbSig70 contains the GUID for the module. However, if I delete the PDB file, the call succeeds but the GUID is empty.

I know that the information is in the exe file since dumpbin.exe /headers [exefile] can display the GUID information without the PDB file.

The question is how to obtain this information from the running process. I want this information to be able to have users producing crash reports without a PDB with callstack addresses and module information so that I can look up the symbols using a symbol server at a later time.

Answer 1

Was trying to do the same thing and found this:

struct CV_INFO_PDB70
{
    DWORD  CvSignature;
    GUID Signature;
    DWORD Age;
    BYTE PdbFileName[];
};

ULONG dirEntrySize;
BOOLEAN mappedAsImage = TRUE;
size_t imageAddress = static_cast<size_t>(IMAGEHLP_MODULEW64_VAR.BaseOfImage);
IMAGE_DEBUG_DIRECTORY* debugDirectory = reinterpret_cast<IMAGE_DEBUG_DIRECTORY*>(sImageDirectoryEntryToDataEx(reinterpret_cast<PVOID>(imageAddress), mappedAsImage, IMAGE_DIRECTORY_ENTRY_DEBUG, &dirEntrySize, NULL));    size_t debugEnd = reinterpret_cast<size_t>(debugDirectory) + dirEntrySize;
while(reinterpret_cast<size_t>(debugDirectory) < debugEnd)
{
    if(debugDirectory->Type == IMAGE_DEBUG_TYPE_CODEVIEW)
    {
        break;
    }
    ++debugDirectory;
}
CV_INFO_PDB70* information = reinterpret_cast<CV_INFO_PDB70*>(static_cast<DWORD>(imageAddress) + debugDirectory->AddressOfRawData);

There’s more information here:
http://www.debuginfo.com/articles/debuginfomatch.html