References and Further Reading

https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-debug-section

Example YARA Rule for PDB Age

rule ttp_pdb_age_33 {
    meta:
        desc = "This looks for the debug entry `age` value."
    condition:
    uint32(
			uint32(
				pe.rva_to_offset(pe.data_directories[0x6].virtual_address
				)+24)
			+20) == 0x33
}

