5

I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll

What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is possible, like mshtml.dll?

enter image description here

Improve this question

1 Answer 1

Reset to default
6

Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it.

  1. Go to Debug menu -> Debugging Symbol Options.

enter image description here

  1. Provide the local path to the symbol files or to a symbol server.

enter image description here

UPDATE

If ImmDbg successfully loaded the pdb symbol for the specified file, you would get a message in the logs in the form Debugging Information (DIA Format) available below the dll loading event. See the image below for reference.

enter image description here

If even after all this, you cannot load the appropriate symbol for a file, then

  1. You may have misconfigured the symbol path.
  2. In case of local symbol, the PDB file present on the system does not match with the PE.
  3. In case of symbol server, appropriate PDB file could not be found.

In such a case you can run the symcheck tool provided with windbg. Example usage

C:\Program Files\Debugging Tools for Windows (x86)>symchk C:\WINDOWS\system32\kernel32.dll /s C:\WINDOWS\Symbols

SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 1

C:\Program Files\Debugging Tools for Windows (x86)>symchk C:\WINDOWS\system32\mshtml.dll /s C:\WINDOWS\Symbols
SYMCHK: mshtml.dll           FAILED  - mshtml.pdb mismatched or not found

SYMCHK: FAILED files = 1
SYMCHK: PASSED + IGNORED files = 0

UPDATE 2

Screenshot of Immunity Debugger with symbols for mshtml.dll loaded. This is taken from Windows XP SP3.

enter image description here

Other Info: ImmDbg could not download symbols from the MS Symbol Server, so had to use the symcheck tool to download symbol for mshtml.dll .

symchk /r c:\windows\system32\mshtml.dll /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols

The symbol directory should look like this.

C:\symbols>dir
 Volume in drive C has no label.
 Volume Serial Number is 042A-A7E6

 Directory of C:\symbols

06/05/2015  12:39 PM    <DIR>          .
06/05/2015  12:39 PM    <DIR>          ..
04/15/2008  09:21 AM         7,965,696 mshtml.pdb
06/05/2015  11:17 AM                 0 pingme.txt

Next, pointed ImmDbg to C:\symbols\. Used loaddll to load mshtml.dll and it automatically picked up the symbol on loading. This can also be seen in the logs.

enter image description here

Improve this answer
10
  • 2
    Just a note, you can also download the symbol file from here.
    – Dominik Antal
    May 28, 2015 at 9:42
  • I've already done this however look at the image I've updated in my question... the functions name are not shown
    – jyz
    May 28, 2015 at 14:48
  • @jyz What does ImmDbg log says? If it indeed loaded the pdb file it would be written in the logs as Debugging Information (DIA Format) available below the dll loading event.
    – 0xec
    May 28, 2015 at 15:15
  • @ExtremeCoders I tried again, again but this message is not shown. Also, When I start \Program Files(x86)\Microsoft Internet Explorer\iexplorer.exe and navigate mshtml.dll is never loaded! I'm checking in ALT+E and ALT+L modules... any idea?
    – jyz
    May 28, 2015 at 15:34
  • 1
    @jyz You can use the symcheck tool to manually download the symbols, put it in a local symbol folder, point ImmDbg to it and it should load it automatically. Additionally the symbol support in ImmDbg seems to be immature, so you may encounter problems.
    – 0xec
    Jun 5, 2015 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.