I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll
What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is possible, like mshtml.dll?
Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it.
If ImmDbg successfully loaded the pdb symbol for the specified file, you would get a message in the logs in the form
Debugging Information (DIA Format) available below the dll loading event. See the image below for reference.
If even after all this, you cannot load the appropriate symbol for a file, then
In such a case you can run the symcheck tool provided with windbg. Example usage
C:\Program Files\Debugging Tools for Windows (x86)>symchk C:\WINDOWS\system32\kernel32.dll /s C:\WINDOWS\Symbols SYMCHK: FAILED files = 0 SYMCHK: PASSED + IGNORED files = 1 C:\Program Files\Debugging Tools for Windows (x86)>symchk C:\WINDOWS\system32\mshtml.dll /s C:\WINDOWS\Symbols SYMCHK: mshtml.dll FAILED - mshtml.pdb mismatched or not found SYMCHK: FAILED files = 1 SYMCHK: PASSED + IGNORED files = 0
Screenshot of Immunity Debugger with symbols for mshtml.dll loaded. This is taken from Windows XP SP3.
Other Info: ImmDbg could not download symbols from the MS Symbol Server, so had to use the symcheck tool to download symbol for mshtml.dll .
symchk /r c:\windows\system32\mshtml.dll /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols
The symbol directory should look like this.
C:\symbols>dir Volume in drive C has no label. Volume Serial Number is 042A-A7E6 Directory of C:\symbols 06/05/2015 12:39 PM <DIR> . 06/05/2015 12:39 PM <DIR> .. 04/15/2008 09:21 AM 7,965,696 mshtml.pdb 06/05/2015 11:17 AM 0 pingme.txt
Next, pointed ImmDbg to
C:\symbols\. Used loaddll to load mshtml.dll and it automatically picked up the symbol on loading. This can also be seen in the logs.