windbg refferencing symbols is inconsistent

Question

As part of an assignment, I am trying to do some debugging in iexplore.exe (Aurora vulnerability).

After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process.

I verify my symbolpath by using:

.sympathy
Symbol search path is: srv*C:\Users\User\Desktop\Symbols
Expanded Symbol search path is: srv*c:\users\user\desktop\symbols

I know that what I am interested in is inside of mshtml, so I list all the symbols in mshtml via:

x /t /n mshtml!*

Next, I use:

u mshtml!CEventObj::GenericGetElement

To see the function I am interested in and discover that one of the instructions I want to examine is at:

mshtml!CEventObj::GenericGetElement+0x91

I try setting a breakpoint at that address by:

 bp mshtml!CEventObj::GenericGetElement+0x91

Then, I run:

bl

And the breakpoint shown is actually at:

mshtml!CEventObj::GenericGetElement+0x3b

Why isn't my breakpoint at the point I specified ?

Also I have tried using:

u mshtml!CEventObj::GenericGetElement+0x91

And the code is totally different than when I simply unassembled the entire function based on the symbol address for the function.

Any ideas would be greatly appreciated.

Answer 1

due to optimizations which include chunking of functions the offsets in the symbols are rendered irrelevent use actual address to set breakpoints windbg normally shows the actual address in brackets at the end

for example some random function in msxml

0:007> ? msxml3!AbortParse 
Evaluate expression: 1956897309 = 74a3e21d
0:007> # je msxml3!AbortParse l10
msxml3!AbortParse+0x18:
74a3e235 7451            je      msxml3!AbortParse+0x61 (74a3e288)
0:007> bp msxml3!AbortParse+0x61
0:007> bp 74a3e288
0:007> bl
 0 e 74a3e27e     0001 (0001)  0:**** msxml3!AbortParse+0x57
 1 e 74a3e288     0001 (0001)  0:**** msxml3!AbortParse+0x61
0:007> .bpcmds
bp0 0x74a3e27e ;
bp1 0x74a3e288 ;