2

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, whatever) to set breakpoint on it? I would like to know/learn about existing reversing techniques to do it.

2
  • I followed this thread reverseengineering.stackexchange.com/questions/26083/…
    – ruakh
    Sep 8 at 10:04
  • 1
    Two options. First one: you open up the binary in a disassembler (let's say IDA), you find the function you are interested in. Grab it's address, subtract it from the base address and you'll have the relative offset. Then fire up x64dbg, add this offset to the loaded base address and you can put a bp on it. Second option: load the binary in x64dbg, open the 'Symbols' tab, and search for your target function (if it have a meaningful name). You can also break on this and you are good to go :)
    – Guillaume
    Sep 8 at 11:22
4

x64dbg can load the pdb and list all the function names if you have pdb for your executable

view->modules->download symbols for this module enter image description here also x64dbg can use the source file (ctrl+shift+s) enter image description here

just for completion sake windbg usage

:\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64


CommandLine: winchk.exe


ntdll!LdrpDoDebuggerBreak+0x30:
00007ffa`055f108c cc              int     3
0:000> cdb: Reading initial command '.lines;bp `winchk.cpp:17`'
Line number information will be loaded
0:000> bl
 0 e 00007ff7`ad0f1090     0001 (0001)  0:**** winchk!main
0:000> g
Breakpoint 0 hit
winchk!main:
00007ff7`ad0f1090 4883ec38        sub     rsp,38h
0:000>

you can use the dbh.exe in windbg installation folder to rebase and get exact address

winchk [1000000]: x *

 index            address     name
     1            1001090 :   main
     3            1001060 :   atest
     5            1001000 :   ctest
     6            1001030 :   btest

winchk [1000000]: base 0x400000


winchk [400000]: x *

 index            address     name
     1             401090 :   main
     3             401060 :   atest
     5             401000 :   ctest
     6             401030 :   btest

winchk [400000]:
1
  • That's exactly what I needed, thank you!
    – ruakh
    Sep 8 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.