[原创]利用GET请求从微软符号服务器下载PDB-编程技术-看雪-安全社区|安全招聘|kanxue.com

[原创]利用GET请求从微软符号服务器下载PDB

2022-9-12 21:33 11166

[原创]利用GET请求从微软符号服务器下载PDB

XieAPP

2022-9-12 21:33

11166

使用SymSrvGetFileIndexInfo函数获取到可执行文件对应PDB文件的GUID
然后使用HTTPS协议发送GET请求到微软符号服务器下载PDB文件
下载速度慢的话可以复制PDB文件的下载链接到迅雷中下载
详细代码如下:

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

#include <windows.h>
#include <DbgHelp.h>
#include <WinInet.h>
#include <stdio.h>
 
#pragma comment(lib,"dbghelp.lib")
#pragma comment(lib,"wininet.lib")
 
BOOL DownloadPdbFile(const char *szModuleFileName, const char *szDownloadDir)
{
    HINTERNET hInternet;
    HINTERNET hConnect;
    HINTERNET hRequest;
    char buf[512];
    char szGuid[128];
    SYMSRV_INDEX_INFO info;
    BOOL bReturn = FALSE;
    ZeroMemory(&info, sizeof(info));
    info.sizeofstruct = sizeof(info);
 
    //////////////////////////////////////////////////////
    //    查询模块文件的GUID信息;
 
    if (!SymSrvGetFileIndexInfo(szModuleFileName, &info, 0))
    {
 
        printf("error : SymSrvGetFileIndexInfo:[%d]", GetLastError());
        return FALSE;
    }
 
    //////////////////////////////////////////////////////
    //    GUID转换为文本;
    sprintf_s(szGuid, sizeof szGuid,
        "%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X%X",
        info.guid.Data1,
        info.guid.Data2,
        info.guid.Data3,
        info.guid.Data4[0],
        info.guid.Data4[1],
        info.guid.Data4[2],
        info.guid.Data4[3],
        info.guid.Data4[4],
        info.guid.Data4[5],
        info.guid.Data4[6],
        info.guid.Data4[7],
        info.age);
 
 
    printf(
        "下载链接:https://msdl.microsoft.com/download/symbols/%s/%s/%s\n",
        info.pdbfile,
        szGuid,
        info.pdbfile);
 
    printf("下载目录:%s\n", szDownloadDir);
 
    system("pause");
 
 
    hInternet = InternetOpenW(L"Microsoft-Symbol-Server/10.1710.0.0", 0, 0, 0, 0);
    if (hInternet)
    {
        hConnect = InternetConnectW(
            hInternet,
            L"msdl.microsoft.com",
            INTERNET_DEFAULT_HTTPS_PORT,
            NULL,
            NULL,
            INTERNET_SERVICE_HTTP,
            0,
            NULL);
 
        if (hConnect)
        {
            /////////////////////////////////////////////////
            // 页面地址;
            sprintf_s(
                buf,
                sizeof buf,
                "/download/symbols/%s/%s/%s",
                info.pdbfile,
                szGuid,
                info.pdbfile);
 
            hRequest = HttpOpenRequestA(
                hConnect,
                "GET",
                buf,
                "HTTP/1.0",
                NULL,
                NULL,
                INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE | INTERNET_FLAG_SECURE | INTERNET_FLAG_KEEP_CONNECTION,
                NULL);
 
            if (hRequest)
            {
                DWORD dwFlags = 0;
                DWORD dwLen = sizeof(dwFlags);
 
                InternetQueryOption(
                     hRequest, 
                     INTERNET_OPTION_SECURITY_FLAGS,
                     (LPVOID)&dwFlags,
                      &dwLen);
                dwFlags |=
                     SECURITY_FLAG_IGNORE_UNKNOWN_CA;
                dwFlags |=
                     SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
                dwFlags |=
                     SECURITY_FLAG_IGNORE_CERT_CN_INVALID;
                InternetSetOption(
                    hRequest,     
                    INTERNET_OPTION_SECURITY_FLAGS,
                    &dwFlags, 
                    sizeof dwFlags);
 
 
                printf("发送GET请求...\n");
                if (HttpSendRequestW(hRequest, NULL, 0, NULL, 0))
                {
                    DWORD dwStatus = 0;
                    DWORD dwIndex = 0;
                    dwLen = sizeof(dwStatus);
 
                    ////////////////////////////////////////
                    //获取页面返回状态;
                    if (HttpQueryInfoW(
                        hRequest,
                        HTTP_QUERY_FLAG_NUMBER | HTTP_QUERY_STATUS_CODE,
                        &dwStatus,
                        &dwLen,
                        &dwIndex) && dwStatus == HTTP_STATUS_OK)
                    {
                        DWORD dwFileSize = 0;
                        dwLen = sizeof(dwFileSize);
                        dwIndex = 0;
                        /////////////////////////////////////
                        //获取PDB文件大小;
                        if (HttpQueryInfoW(
                            hRequest,
                            HTTP_QUERY_CONTENT_LENGTH | HTTP_QUERY_FLAG_NUMBER,
                            &dwFileSize,
                            &dwLen,
                            &dwIndex) && dwFileSize)
                        {
                            printf("文件总大小:%dKB", dwFileSize / 1024);
 
                            ////////////////////////////////
                            //申请缓冲区;
                            LPVOID lpBuffer;
                            lpBuffer = VirtualAlloc(NULL, dwFileSize, MEM_COMMIT, PAGE_READWRITE);
                            if (lpBuffer)
                            {
                                /////////////////////////////
                                //为PDB文件创建目录;
                                CreateDirectoryA(szDownloadDir, NULL);
 
                                //下载目录//PDB文件名;
                                sprintf_s(
                                    buf,
                                    sizeof buf,
                                    "%s\\%s",
                                    szDownloadDir,
                                    info.pdbfile);
                                CreateDirectoryA(buf, NULL);
 
                                //下载目录//PDB文件名//GUID;
                                sprintf_s(
                                    buf,
                                    sizeof buf,
                                    "%s\\%s\\%s",
                                    szDownloadDir,
                                    info.pdbfile, szGuid);
                                CreateDirectoryA(buf, NULL);
 
                                //创建一个空白的PDB文件用于写入接收到的数据;
                                HANDLE hFile;
 
 
                                sprintf_s(
                                    buf,
                                    sizeof buf,
                                    "%s\\%s\\%s\\%s",
                                    szDownloadDir,
                                    info.pdbfile,
                                    szGuid,
                                    info.pdbfile);
 
                                hFile = CreateFileA(
                                    buf,
                                    GENERIC_READ | GENERIC_WRITE,
                                    0,
                                    NULL,
                                    CREATE_ALWAYS,
                                    FILE_ATTRIBUTE_NORMAL,
                                    NULL);
 
                                if (hFile != INVALID_HANDLE_VALUE)
                                {
                                    DWORD dwRecvSize = 0;
                                    //循环获取可接收的数据大小,直到接收完成;
                                    while (
                                        (InternetQueryDataAvailable(hRequest, &dwLen, 0, 0)) && 
                                        dwLen &&
                                        (dwRecvSize + dwLen) <= dwFileSize)
                                    {
                                        bReturn = TRUE;
 
                                        //读取数据;
                                        if (InternetReadFile(hRequest, (char*)lpBuffer + dwRecvSize, dwLen, &dwLen))
                                        {
                                            dwRecvSize += dwLen;
                                            printf(
                                                "下载文件:%dKB/%dKB : %d%s\r\n", 
                                                dwRecvSize / 1024,
                                                dwFileSize / 1024,
                                                (DWORD)((double)dwRecvSize / (double)dwFileSize * 100.0),
                                                "%");
                                        }
                                        else
                                        {
                                            bReturn = FALSE;
                                            printf("error : InternetReadFile:[%d]", GetLastError());
                                            break;
                                        }
                                    }
 
                                    if (bReturn)
                                    {
                                        bReturn = WriteFile(hFile, lpBuffer, dwRecvSize, &dwRecvSize, NULL);
                                        if (bReturn)
                                        {
                                            printf("下载完成!\n");
                                        }
                                        else
                                        {
                                            printf("error : WriteFile:[%d]", GetLastError());
                                        }
                                    }
 
                                    CloseHandle(hFile);
                                }else printf("error : CreateFileA:[%d]", GetLastError());
                                VirtualFree(lpBuffer, 0, MEM_RELEASE);
 
                            } else printf("error : VirtualAlloc:[%d]", GetLastError());
 
                        } else printf("error : HttpQueryInfoW.GetFileSize:[%d]", GetLastError());
 
                    }else printf("error : HttpQueryInfoW.GetStatus:[%d]", GetLastError());
 
                } else printf("error : HttpSendRequestW:[%d]", GetLastError());
 
                InternetCloseHandle(hConnect);
            } else printf("error : HttpOpenRequestA:[%d]", GetLastError());
 
 
            InternetCloseHandle(hConnect);
        } else printf("error : InternetConnectW:[%d]", GetLastError());
 
 
        InternetCloseHandle(hInternet);
    } else printf("error : InternetOpenW:[%d]", GetLastError());
 
 
 
    return bReturn;
}
 
int main()
{
    DownloadPdbFile("C:\\Windows\\System\\win32k.sys", "C:\\Symbols");
    return 0;
}

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界

#系统内核 #驱动开发 #开源分享 #开发技巧

收藏・22

点赞・5

打赏

最新回复 (4)
caolinkai 雪币： 3624 活跃值： (3783) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 808 粉丝 1 关注私信	caolinkai 2022-9-13 08:43 2 楼 0 感谢分享
七夜大大雪币： 5168 活跃值： (3257) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 7 粉丝 1 关注私信	七夜大大 2022-9-13 08:51 3 楼 0 感谢分享
Pilky01 雪币： 219 能力值： ( LV1，RANK：0 ) 在线值：发帖 2 回帖 1 粉丝 0 关注私信	Pilky01 2024-1-29 12:34 4 楼 0 error : HttpQueryInfoW.GetStatus:[400]
秋狝雪币： 19103 活跃值： (28707) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 1534 粉丝 28 关注私信	秋狝 2024-1-31 09:38 5 楼 1 感谢分享
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复

XieAPP

发帖

回帖

RANK

关注

私信

他的文章

[原创]利用GET请求从微软符号服务器下载PDB

关于我们

联系我们

企业服务

看雪公众号