Questions tagged [debugging-symbols]

Extra information added to help for debugging purpose. It gathers information about each variable, type, procedure, etc, and link the assembly code to source code. Usual debugging-symbols formats includes DWARF, stabs, PDB ...

0
votes
0answers
39 views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
0
votes
0answers
82 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
0
votes
1answer
44 views

Does the Radare Debugger support STABS?

From the wiki on Stabs stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers. Does Radare ...
4
votes
1answer
68 views

Using debug symbols of an older exe for a newer exe

Sorry for the question if anything is wrong, I'm new to StackOverflow. I have DWARF debug file of a C++ Mac program of version (i.e. 1.1). Is there any way to use this debug information in a newer ...
0
votes
1answer
271 views

PE: Strange entry in debug directory (Type: 0xc)

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here. I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2. Now I have ...
2
votes
1answer
126 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files? Is it safe to assume that all Visual Studio compiled PE files have all debug ...
5
votes
0answers
599 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
2
votes
2answers
680 views

Obtain .exe/.dll/.sys for a given .pdb file

If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
3
votes
1answer
1k views

How to add standard symbolic constants with bitwise operators (like ORs)

I am working with IDA and I have the OpenProcess function receiving dwDesireAccess of 0x410: According to MSDN we can see that 0x410 is the result of OR between two access rights: ...
3
votes
1answer
328 views

Symbols visible in EXE file without PDB

I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
1
vote
0answers
651 views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
2
votes
2answers
458 views

How to extract debug information from a DOS executable compiled with Watcom C/C++?

I have a DOS executable which has been compiled with Watcom C/C++ 10.0. That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
2
votes
2answers
901 views

Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?

After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.188869 (modified 25/5/15) to 6.1.7601.18933 (modified 15/07/2015). Since then, !peb, !teb, !address ...
5
votes
1answer
1k views

Load IE symbols in Immunity Debugger

I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is ...
1
vote
1answer
119 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
0
votes
1answer
3k views

IDAPython load PDB-file of analysed binary

in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File). I know how to load a PDB-File via GUi but I need this scripted. Has ...
1
vote
1answer
1k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
2
votes
1answer
2k views

IDA Can't load symbols “DIA: No such interface supported”

I'm trying to load symbols for a dll with IDA pro. My _NT_SYMBOL_PATH is SRV*c:\symbols*http://msdl.microsoft.com/download/symbols . I put DBGTOOLS = "C:\\Program Files (x86)\\Windows Kits\\8.1\\...
10
votes
1answer
451 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
5
votes
0answers
178 views

How to find the symbol table in a TI DSP. (TMS320C5510)

That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
4
votes
1answer
731 views

SQL Server not downloading symbols from the symbol server, even though SymInitialize has the symserver in its path

EDIT Clarified, I meant the extended exent ringbugger stacktraces described by Jonathan Kehayias. I recently discovered it was possible to get link.exe, dumpbin.exe, etc to download symbols from a ...
8
votes
5answers
5k views

How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?

I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is: Unable to enumerate locals, HRESULT 0x80004005 ...
4
votes
1answer
226 views

Safari windows debugging symbols

Apple developer network site has a small guide about setting up debugging symbols server for Safari browser on Windows. But it doesn't work. First, the link to actual symbols server gets redirected ...