What Is a .PDB File?

Windows Program Database (.pdb)

Overview

A PDB (Program Database) file holds the debugging and symbol information for a Windows binary. It maps compiled machine code back to the source that produced it: function and variable names, line numbers, type definitions, and the layout of local variables on the stack.

Without a PDB, a crash dump shows raw addresses. With the matching PDB, the same dump shows a readable call stack with file names and line numbers. This is why PDB files are central to any serious Windows debugging or crash-reporting workflow.

Note the extension collision: .pdb is also the Protein Data Bank format for molecular structures, an entirely unrelated plain-text format. See PROTEINDB for that one. Content-based detection is the only reliable way to tell them apart.

Technical Specifications

Format Details

• MIME Type: application/octet-stream
• File Extension: .pdb
• Category: Binary
• Structure: MSF (Multi-Stream Format) container
• Magic string: Microsoft C/C++ MSF 7.00\r\n\x1aDS\x00\x00\x00
• Produced by: MSVC, Clang on Windows, Delphi, and the .NET compilers
• Variants: native (Windows PDB) and Portable PDB (.NET)

Identification

head -c 32 app.pdb | strings
# Microsoft C/C++ MSF 7.00

A Portable PDB, used by modern .NET, is a different format entirely: it begins with the BSJB signature shared by ECMA-335 metadata, and is far simpler and smaller than the native format.

File Structure

A native PDB is an MSF file: effectively a small block-based filesystem containing numbered streams:

app.pdb (MSF container)
├── Superblock            block size, block map, directory location
├── Stream 1  PDB Info    GUID + age, matched against the binary
├── Stream 2  TPI         type information records
├── Stream 3  DBI         module list, section map, source file list
├── Stream 4  IPI         inline and source-file ID records
├── Stream n  Module info per-object-file symbols and line numbers
├── Stream n  Global symbols
├── Stream n  Public symbols
└── Stream n  Source file checksums

GUID and age matching

The PDB Info stream holds a GUID and an age counter. The corresponding PE binary records the same pair in its debug directory, along with the PDB path. A debugger loads a PDB only when the GUID and age match exactly - this prevents mismatched symbols, which would produce confidently wrong stack traces.

This pairing is also how symbol servers work: the debugger builds a lookup key from the GUID and age and requests exactly that build's symbols.

Portable PDB

.NET Core introduced Portable PDB, which stores debug information using the same metadata table format as assemblies:

• Cross-platform, unlike the Windows-only MSF format
• Much smaller
• Can be embedded directly in the assembly (<DebugType>embedded</DebugType>)
• Supports Source Link, mapping each source file to a URL in the origin repository so debuggers fetch exact source on demand

History and Development

PDB files date to Microsoft's early Visual C++ releases, replacing the older CodeView debug information that was embedded directly in executables. Moving symbols to a separate file kept shipped binaries small while preserving full debuggability internally.

Microsoft did not publish a specification for many years; the format was accessed only through the DIA SDK (Debug Interface Access) COM interface. The LLVM project reverse-engineered and documented much of it while implementing PDB emission for clang-cl, and Microsoft later open-sourced portions of the reference implementation.

Common Use Cases

• Crash dump analysis: turning a minidump into a readable call stack.
• Live debugging: stepping through source in Visual Studio or WinDbg.
• Production crash reporting: services symbolicate incoming crash reports against archived PDBs.
• Profiling: attributing CPU samples to source functions and lines.
• Reverse engineering and security research: when symbols are available, analysis becomes far easier.
• Post-mortem analysis of released builds: retaining PDBs for shipped versions.

How to Open a PDB File

PDB files are not meant to be read directly; they are consumed by debuggers. Still, several tools inspect them:

Microsoft tooling

REM Dump PDB contents (Visual Studio Developer Command Prompt)
dia2dump -all app.pdb

REM Show the PDB signature a binary expects
dumpbin /headers app.exe | findstr /i pdb

REM Symbol checker: verify a PDB matches a binary
symchk /v app.exe /s .

LLVM tooling

# Cross-platform PDB inspection
llvm-pdbutil dump --summary app.pdb
llvm-pdbutil dump --symbols --lines app.pdb
llvm-pdbutil dump --streams app.pdb

Debuggers

• Visual Studio: loads PDBs automatically for local builds; configure symbol paths under Debug → Options → Symbols.
• WinDbg / WinDbg Preview: set .sympath and run .reload.
• x64dbg: loads PDBs for user-mode debugging.

Symbol servers

REM Point at the Microsoft public symbol server plus a local cache
set _NT_SYMBOL_PATH=srv*C:\symbols*https://msdl.microsoft.com/download/symbols

For your own builds, symstore.exe publishes PDBs into a symbol store indexed by GUID and age.

Security Considerations

PDB files leak information. They contain full source file paths from the build machine, internal function and variable names, type layouts, and sometimes fragments of source. Shipping PDBs alongside a public binary hands reverse engineers a substantial advantage.

The standard practice is to strip PDBs from distributed packages and archive them privately in a symbol store, so crash reports can still be symbolicated internally. For .NET, <DebugType>portable</DebugType> with PDBs published separately achieves the same.

Advantages

• Rich debugging information: full types, locals, and line mappings.
• Keeps binaries small: symbols live outside the shipped executable.
• Precise build matching: GUID and age prevent mismatched symbols.
• Symbol server integration: the right symbols are fetched automatically.
• Portable PDB is cross-platform: a genuine improvement for .NET.

Limitations

• Windows-centric: the native format is tied to the Microsoft toolchain.
• Historically undocumented: third-party support required reverse engineering.
• Large: PDBs are often bigger than the binaries they describe.
• Fragile pairing: a rebuilt binary invalidates the old PDB entirely.
• Information disclosure: leaks paths, names, and structure if distributed.

Related Formats

• PEBIN: the Windows executable format PDBs accompany.
• PROTEINDB: the unrelated Protein Data Bank format sharing the .pdb extension.
• ELF: the Unix binary format, which typically carries DWARF debug info instead.
• MACHO: the macOS binary format, which uses dSYM bundles for the same purpose.