As part of an assignment, I am trying to do some debugging in iexplore.exe (Aurora vulnerability).

After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process.

I verify my symbolpath by using:

Symbol search path is: srv*C:\Users\User\Desktop\Symbols
Expanded Symbol search path is: srv*c:\users\user\desktop\symbols

I know that what I am interested in is inside of mshtml, so I list all the symbols in mshtml via:

x /t /n mshtml!*

Next, I use:

u mshtml!CEventObj::GenericGetElement

To see the function I am interested in and discover that one of the instructions I want to examine is at:


I try setting a breakpoint at that address by:

 bp mshtml!CEventObj::GenericGetElement+0x91

Then, I run:


And the breakpoint shown is actually at:


Why isn't my breakpoint at the point I specified ?

Also I have tried using:

u mshtml!CEventObj::GenericGetElement+0x91

And the code is totally different than when I simply unassembled the entire function based on the symbol address for the function.

Any ideas would be greatly appreciated.

  • What are those assignments? Where do you get them from? – Thomas Weller Nov 13 '14 at 21:31

due to optimizations which include chunking of functions the offsets in the symbols are rendered irrelevent use actual address to set breakpoints windbg normally shows the actual address in brackets at the end

for example some random function in msxml

0:007> ? msxml3!AbortParse 
Evaluate expression: 1956897309 = 74a3e21d
0:007> # je msxml3!AbortParse l10
74a3e235 7451            je      msxml3!AbortParse+0x61 (74a3e288)
0:007> bp msxml3!AbortParse+0x61
0:007> bp 74a3e288
0:007> bl
 0 e 74a3e27e     0001 (0001)  0:**** msxml3!AbortParse+0x57
 1 e 74a3e288     0001 (0001)  0:**** msxml3!AbortParse+0x61
0:007> .bpcmds
bp0 0x74a3e27e ;
bp1 0x74a3e288 ;
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.