Process Memory Map, starting with version 1.7.4, opens a new stage in the utility’s development — support for debug PDB files, along with future development that will bring a more complete and accurate representation of system structures, extracted from the most up-to-date debug information.

At this stage, the current engine provides only the most basic functionality — namely, extracting function addresses in system libraries.

In addition to the PDB parsing engine working in RAW mode, support has been added for PDB symbol stores (both single-level and two-level), whether local or remote.

Why this is necessary: the standard library for working with debug PDB symbols, installed by default in Windows, offers extremely minimal functionality.

It does not allow full-featured work with PDB and requires replacing it with dbghlp.dll, which ships as part of the SDK. Manually parsing the MSF container, in which debug PDB data is stored, allows working with the full dataset and removes unnecessary dependencies on external libraries. The same applies to the symsrv.dll library, which handles working with symbol stores — all functionality needed from this library has been implemented manually.

During development and debugging, it became clear that some tool was needed for maintaining local symbol stores. This is because Microsoft stopped publishing symbols as a separate installer, providing debugger developers only with an external MSIL link, so some external code needs to be responsible for keeping debug information in the stores up to date and clearing out outdated data. This is exactly what has been implemented in the form of a PDB store manager.

There are two modes when connecting to a process. In the first, debug information is updated immediately during the analysis of libraries from the remote process — this is slow and significantly slows down the initial opening of a process whose libraries lack up-to-date debug information.

The second mode skips loading at the initialization stage and lets the user perform the necessary debug download through the PDB store manager, which will show exactly which libraries require updated debug information.

Loading modes are switched in the settings; by default, loading through the PDB symbol store manager is enabled.

The manager will also provide the ability to view outdated PDB symbols and unknown PDB symbols — cases where the file for which a PDB was downloaded is missing from disk. Switching modes is done through the filter menu.

Going forward, the engine will be expanded, since it will need functionality for extracting types and structures stored in PDB, so that the current state of their fields can be displayed for the current operating system.

The next release is planned for late October / early November. It will expand search capabilities and also speed up the search itself, since due to the recently added mode for searching references to a specified address, searching in that mode has become fairly resource-intensive and requires significant optimization.