CodeView Parsing Code

http://www.twitter.com/waleedassar
//The following is only for educational purposes demonstrating a bug found in IDA Pro.
//For more info:
//http://waleedassar.blogspot.com/2012/06/ida-pro-and-codeview-debug-info-bug.html

//global variables.

unsigned long cv_version;
unsigned long shitty;
unsigned long shitty2;

//The following structure is used with PDB v2.00
struct CV_INFO_PDB20
{
     unsigned long Signature; //e.g. NB10
     unsigned long Reserved;  //Usually zero
     unsigned long TimeDateStamp; //Seconds elapsed since 01/01/1970
     unsigned long Age;//This field is incremented with each time CV info is embedded e.g. relinking
     unsigned char PdbFileName[1]; //Null-terminated string.
};

struct CV_INFO_PDB20
{
     unsigned long Signature; //e.g. RSDS
     GUID          Guid;
     unsigned long Age; //This field is incremented with each time CV info is embedded e.g. relinking
     unsigned char PdbFileName[1]; //Null-terminated string.
};

struct CV_INFO2
{
         unsigned short ID;
         unsigned short Pad;
         unsigned long  Offset;
};
struct CV_INFO
{
       unsigned short Sign; //always 0x10
       unsigned short Incrementer;
       unsigned long NumberOfXX;
       unsigned long unk1;
       unsigned long unk2;
       CV_INFO2 info;
};

bool IsSupported_CodeView(void* pCodeView)
{
        if(!strncmp((char*)pCodeView,"NB02",0x4)
        ||  !strncmp((char*)pCodeView,"NB05",0x4)
        ||  !strncmp((char*)pCodeView,"NB08",0x4)
        ||  !strncmp((char*)pCodeView,"NB09",0x4)
        ||  !strncmp((char*)pCodeView,"NB11",0x4) ) return true;
        return false;
}

void CodeView_function(void* pCodeView, unsigned long size_codeview)
{
    //Test for PDB v2.00 and PDB v7.00
    if(       *(unsigned long*)pCodeView=='01BN'  /* PDB v2.00 */ ||
              *(unsigned long*)pCodeView=='SDSR'  /* PDB v7.00 */   )
    {
             run_plugin(load_plugin("pdb"),0x1);
             return;
    }
    call_CallUi("Loading CODEVIEW debug information...\n");
    if(!IsSupported_CodeView(pCodeView))
    {
            call_CallUi("Unknown codeview information format: %4.4s",pCodeView);
            return;
    }
    unsigned long c1=*((unsigned char*)pCodeView+2);  //NB02 --> '0'
    unsigned long c2=*((unsigned char*)pCodeView+3);  //NB02 --> '2'
    cv_version=c2+(c1*10)-0x210;  //evaluate to 0x2 ('02' to 0x2)
    unsigned long block_size=*((unsigned long*)pCodeView+1);  //header size
    if(block_size==-1)
    {
          call_CallUi("Borland debug information is ignored\n";
          return;
    }
    if( (block_size<size) && ( ((CV_INFO*)((unsigned long)pCodeView+block_size))->Sign==0x10))
    {
          unsigned long i=0;
          shitty=i;

          unsigned long* pNumberOfXX=&(((CV_INFO*)((unsigned long)pCodeView+block_size))->NumberOfXX);
          shitty2=i;

          CV_INFO2* pInfo=&(((CV_INFO*)((unsigned long)pCodeView+block_size))->info);   //esp+0x10

          if(*pNumberOfXX>0)
          {
                 unsigned long* pIncrementer=((CV_INFO*)((unsigned long)pCodeView+block_size))->Incrementer;  //esp+0x14
                 do
                 {
                          unsigned long id=pInfo->ID;
                          unsigned long Ptr=(unsigned long)pCodeView+(pInfo->Offset);
                          //eeexx+=pCodeView;
                          if(id==0x12E)
                          {
                                   //
                          }
                          else if(id==0x12D)
                          {
                                  unsigned short xxx=*(unsigned short*)Ptr;
                                  Ptr++;
                                  gID=id;
                                  shitty1=Ptr;
                          }
                          i++;
                          pInfo=(unsigned long)pInfo+(*pIncrementer);
                 }while(i<*pNumberOfXX);
          }
    }
    call_CallUi("Invalid Codeview debug information");
    return;
}