Function ExtractEmbeddedPDB

source/EmbedPDB/main.cpp:87–193

}

std::optional<std::vector<uint8_t>> ExtractEmbeddedPDB(const fs::path& filePath, bool forceScan)
{
    std::ifstream file(filePath, std::ios::binary | std::ios::ate);
    if (!file) return {};

    auto fileSize = file.tellg();
    if (fileSize < 32) return {};

    // --- Fast path: check the very end of the file ---
    file.seekg(fileSize - std::streamoff(32));
    std::array<uint8_t, 32> tail{};
    file.read(reinterpret_cast<char*>(tail.data()), 32);

    if (std::equal(kMagic.begin(), kMagic.end(), tail.begin() + 16))
    {
        uint64_t originalSize = *reinterpret_cast<uint64_t*>(tail.data());
        uint64_t compressedSize = *reinterpret_cast<uint64_t*>(tail.data() + 8);

        if (compressedSize == 0 || compressedSize > static_cast<uint64_t>(fileSize) - 32)
            return {};

        file.seekg(fileSize - std::streamoff(32) - std::streamoff(compressedSize));
        std::vector<uint8_t> compressed(compressedSize);
        file.read(reinterpret_cast<char*>(compressed.data()), compressedSize);

        std::vector<uint8_t> decompressed;
        if (DecompressData(compressed, originalSize, decompressed))
            return decompressed;
    }

    // --- Signed PE path: check just before the Authenticode certificate ---
    uint64_t secOffset = GetPESecurityOffset(file, fileSize);
    if (secOffset >= 32)
    {
        // Signing tools may insert alignment padding (up to 7 bytes) before
        // the certificate, so scan a small 64-byte window before it.
        constexpr std::streamoff kScanWindow = 64;
        auto scanStart = std::max(std::streamoff(0), std::streamoff(secOffset) - kScanWindow);
        auto scanLen = static_cast<size_t>(std::streamoff(secOffset) - scanStart);

        if (scanLen >= 32)
        {
            file.seekg(scanStart);
            std::vector<uint8_t> buf(scanLen);
            file.read(reinterpret_cast<char*>(buf.data()), scanLen);

            if (file.good())
            {
                for (size_t pos = scanLen - 16; pos >= 16; --pos)
                {
                    if (std::equal(kMagic.begin(), kMagic.end(), buf.begin() + pos))
                    {
                        uint64_t originalSize = *reinterpret_cast<uint64_t*>(buf.data() + pos - 16);
                        uint64_t compressedSize = *reinterpret_cast<uint64_t*>(buf.data() + pos - 8);

                        auto trailerFileOff = scanStart + std::streamoff(pos - 16);
                        if (compressedSize > 0 && compressedSize <= static_cast<uint64_t>(trailerFileOff))
                        {