This post led me to chkmatch . On the processed dll, chkmatch displays this information:
Executable:
TimeDateStamp: 4a086937
Debug info: 2 (CodeView)
TimeStamp: 4a086937 Characteristics: 0 MajorVer: 0 MinorVer: 0
Size: 123 RVA: 00380460 FileOffset: 00380460
CodeView signature: sUar
Debug information file:
Format: PDB 7.00
Result: unmatched (reason: incompatible debug information formats)
With the same pdb against a preprocessed dll, it reports this:
Executable:
TimeDateStamp: 4a086937
Debug info: 2 (CodeView)
TimeStamp: 4a086937 Characteristics: 0 MajorVer: 0 MinorVer: 0
Size: 123 RVA: 00380460 FileOffset: 00380460
CodeView format: RSDS
Signature: (my guid) Age: 19
PdbFile: (my path)
Debug information file:
Format: PDB 7.00
Signature: (my matching guid) Age: 19
I opened both versions of the dll and switched to offset 00380460. In the original version, I see the name pdb quite clearly, but in the post-processed version there is no pdb data at this offset. I searched the pdb path and found the same block - only with a different offset. Then I searched in bytes "38 00 60 04" in the original dll. If you look at the same offset in the processed dll, I found the same bytes. Therefore, I adjusted the RVA and offset (located by matching bytes). Bingo! Now chkmatch reports the same results for the processed dll as the original (except for RVA and FileOffset, which I changed).
Edit : confirmed, now Visual Studio loads symbols for dumps that reference the processed DLL.
sean e
source share