I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll
What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is possible, like mshtml.dll?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityImmunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it.
UPDATE
If ImmDbg successfully loaded the pdb symbol for the specified file, you would get a message in the logs in the form Debugging Information (DIA Format) available
below the dll loading event. See the image below for reference.
If even after all this, you cannot load the appropriate symbol for a file, then
In such a case you can run the symcheck tool provided with windbg. Example usage
C:\Program Files\Debugging Tools for Windows (x86)>symchk C:\WINDOWS\system32\kernel32.dll /s C:\WINDOWS\Symbols
SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1
C:\Program Files\Debugging Tools for Windows (x86)>symchk C:\WINDOWS\system32\mshtml.dll /s C:\WINDOWS\Symbols
SYMCHK: mshtml.dll FAILED - mshtml.pdb mismatched or not found
SYMCHK: FAILED files = 1
SYMCHK: PASSED + IGNORED files = 0
UPDATE 2
Screenshot of Immunity Debugger with symbols for mshtml.dll loaded. This is taken from Windows XP SP3.
Other Info: ImmDbg could not download symbols from the MS Symbol Server, so had to use the symcheck tool to download symbol for mshtml.dll .
symchk /r c:\windows\system32\mshtml.dll /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols
The symbol directory should look like this.
C:\symbols>dir
Volume in drive C has no label.
Volume Serial Number is 042A-A7E6
Directory of C:\symbols
06/05/2015 12:39 PM <DIR> .
06/05/2015 12:39 PM <DIR> ..
04/15/2008 09:21 AM 7,965,696 mshtml.pdb
06/05/2015 11:17 AM 0 pingme.txt
Next, pointed ImmDbg to C:\symbols\
. Used loaddll to load mshtml.dll and it automatically picked up the symbol on loading. This can also be seen in the logs.
Debugging Information (DIA Format) available
below the dll loading event.
mshtml.dll
is never loaded! I'm checking in ALT+E
and ALT+L
modules... any idea?