Home

Awesome

bao - the PDB compiler

bao allows you to generate debug information from C code in the CodeView format, which is mostly known for its use in PDBs. JSON is used to assign the types and functions to addresses within the binary.

Showcase

To showcase how bao works I will use a module from Valve's anti-cheat "solution" VAC. It's an ideal sample to test on, because the modules are rather small and as such can be fully analyzed very easily. Complimenting these conditions is the fact that the different modules are similar to each other as all of them I've analyzed contain the ICE cipher.

Before

Before

After applying a generated PDB by Bao

After

Code

int ice_sboxes_initialised;
struct IceKey {
    int		_size;
    int		_rounds;
    struct  IceSubkey	*_keysched;
};

struct IceKey* __thiscall IceKey__IceKey(struct IceKey*, int nRounds);
void* __fastcall VAC_malloc(size_t dwBytes);
void ice_sboxes_init(void);

Configuration

{
  "functions": [
    {
      "name": "IceKey__IceKey",
      "pattern": "56 57 33 FF"
    },
    {
      "name": "VAC_malloc",
      "pattern": "E8 ? ? ? ? 89 7E 04",
      "extra": 1,
      "rip_relative": true,
      "rip_offset": 4
    },
    {
      "name": "ice_sboxes_init",
      "pattern": "75 0B E8 ? ? ? ?",
      "extra": 3,
      "rip_relative": true,
      "rip_offset": 4
    }
  ],
  "globals": [
    {
      "name": "ice_sboxes_initialised",
      "pattern": "47 83 3D ? ? ? ? ?",
      "offsets": [
        3
      ],
      "relative": true
    }
  ]
}

Dependencies

Known issues

Usage

Generating the PDB as seen in the example is as easy as running bao -c config.json -- vac.dll src/structs.c. The resulting PDB will be saved as vac.dll.pdb in this example. You may pass the -o option to save the resulting PDB somewhere else.

Setup

The easiest way to run bao is to use Docker:

~$ git clone https://github.com/not-wlan/bao.git
~$ cd bao
~$ docker build . -t bao:latest
~$ docker run -v /path/to/project:/project -it bao:latest
#$ cd /project
#$ bao-pdb -o vac.pdb -c vac.json vac.dll structs.c

The first three commands are only necessary on your first run or after an update of bao.

Alternatively you can install the dependencies on your own machine. Be warned though, this is not recommended on a Windows machine!

Usecases

You can use bao to:

Thanks to