2

I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A.
What steps should I take in order to find out which function this is and/or what it does? The debugger seems to provide some symbols but not all.

Thank you.

2
  • Hey @the_endian, just a reminder -- if you find the answer below helpful, please accept it so the community will be able to focus on other unanswered questions and for users coming from search engines.
    – Megabeets
    Nov 18, 2017 at 8:59
  • @Megabeets Holy cow I have no idea how I didn't see this earlier. I've accepted the answer.
    – the_endian
    Jan 30, 2020 at 18:11

1 Answer 1

3

Simply execute downloadsym ntdll in the command field at the bottom of x32dbg.

As you can see in the documentation:

Command: symdownload / downloadsym
Attempt to download a symbol from a Symbol Store.

arguments
[arg1] - Module name (with or without extension) to attept to download symbols for. When not specified, an attempt will be done to download symbols for all loaded modules.

[arg2] - Symbol Store URL. When not specified, the default store will be used.

result
This command does not set any result variables.

This should retrieve the Debugging Symbols from the Microsoft public symbol server and update the assembly accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.