Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, whatever) to set breakpoint on it? I would like to know/learn about existing reversing techniques to do it.
2
-
I followed this thread reverseengineering.stackexchange.com/questions/26083/…– ruakhSep 8, 2021 at 10:04
-
1Two options. First one: you open up the binary in a disassembler (let's say IDA), you find the function you are interested in. Grab it's address, subtract it from the base address and you'll have the relative offset. Then fire up x64dbg, add this offset to the loaded base address and you can put a bp on it. Second option: load the binary in x64dbg, open the 'Symbols' tab, and search for your target function (if it have a meaningful name). You can also break on this and you are good to go :)– GuillaumeSep 8, 2021 at 11:22
Add a comment
|
1 Answer
x64dbg can load the pdb and list all the function names if you have pdb for your executable
view->modules->download symbols for this module
also x64dbg can use the source file (ctrl+shift+s)
just for completion sake windbg usage
:\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
CommandLine: winchk.exe
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffa`055f108c cc int 3
0:000> cdb: Reading initial command '.lines;bp `winchk.cpp:17`'
Line number information will be loaded
0:000> bl
0 e 00007ff7`ad0f1090 0001 (0001) 0:**** winchk!main
0:000> g
Breakpoint 0 hit
winchk!main:
00007ff7`ad0f1090 4883ec38 sub rsp,38h
0:000>
you can use the dbh.exe in windbg installation folder to rebase and get exact address
winchk [1000000]: x *
index address name
1 1001090 : main
3 1001060 : atest
5 1001000 : ctest
6 1001030 : btest
winchk [1000000]: base 0x400000
winchk [400000]: x *
index address name
1 401090 : main
3 401060 : atest
5 401000 : ctest
6 401030 : btest
winchk [400000]:
