Note that there are some explanatory texts on larger screens.

plurals
  1. POMicrosoft Symbol Server / Local Cache Hash Algorithm
    primarykey
    data
    text
    <p>I am trying to figure out what hashing algorithm is used for the Microsoft Symbol Local Cache directory.</p> <p>For example, the local cache can be something like the following</p> <pre> L:\Symbols \browseui.dll \44FBC679fe000 browsue.dll \browseui.pdb \44F402F62 browseui.pdb \explorer.exe \3EBF1F14f7000 explorer.exe \explorer.pdb \3EBF1F141 explorer.pdb \msvcr71.pdb \60D915C6AB6A4F3586E9096E2F8856482 msvcr71.pdb </pre> <p>There seems to be some sort of correspondence between a file and its debug database. Other than that, I can’t figure out how the names of these (presumably) hexadecimal string folders are being generated.</p> <p>Some of them are 9 digits, some 13 digits, and others are 33 digits. It looks like an actual, live-file (which for some reason is stored in the symbol cache) has a 13-digit hash while its (nearly similar) debug database gets a 9-digit hash. Some debug databases get a 13-digit hash; can’t figure out what makes these ones special, although they don’t have a corresponding live-file.</p> <p>I’ve tried hashing the files with every kind of hash algorithm that I know of (39 of them) and none match in any way (straight up, reversed, alternate endian’d, etc.)</p> <p>Any ideas?</p> <p><strong>Update</strong> I think I finally found it. From <a href="http://msdn.microsoft.com/en-us/library/windows/hardware/ff558839(v=vs.85).aspx" rel="nofollow noreferrer">Symbol Storage Format</a>:</p> <blockquote> <p>SymStore uses the file system itself as a database. It creates a large tree of directories, with directory names based on such things as the symbol file time stamps, signatures, age, and other data.</p> </blockquote> <p><strong>Edit</strong> Dang, unfortunately it only mentions that the directory name is derived from various aspects (not quite a hash I guess), but does not say exactly how. The search continues… :-(</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload