Questions tagged [debugging-symbols]
Extra information added to help for debugging purpose. It gathers information about each variable, type, procedure, etc, and link the assembly code to source code. Usual debugging-symbols formats includes DWARF, stabs, PDB ...
38
questions
0
votes
0
answers
106
views
Need Help Cracking a Program
So I've got this .exe that I want to crack. It's an old management system for people in truck loading business.
I kind of understand what's happening with window API calls but I'm unable to access the ...
4
votes
2
answers
2k
views
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
- 10.9k
3
votes
1
answer
199
views
Load PDB for MemoryModule-loaded DLL in x64dbg
I need to debug a DLL, which I have a PDB file for.
The debug target is a program, that loads the DLL using MemoryModule library from Github.
The loaded module isn't listed as a module in x64dbg, ...
- 191
1
vote
2
answers
2k
views
IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging
Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:
Then loaded a test PE file and started debugging it (using Local Windows Debugger):
...
- 111
3
votes
1
answer
3k
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 4,912
1
vote
1
answer
158
views
analyze how data is read in android usb device
I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
- 168
4
votes
2
answers
5k
views
GHIDRA: How to load symbols from a text (map) file
I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
- 158
1
vote
1
answer
826
views
Find functions names in .init_array section in unstripped library
Is it possible to find out all instances of static initialization in a elf dynamic library.
I can dump the array of function pointers in .init_array section via objdump command like this.
objdump -s -...
- 2,629
2
votes
1
answer
880
views
WinDBG doesn't resolve function names when debugging kernel module
I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
Here is a picture ...
- 16.3k
0
votes
1
answer
1k
views
Can I force GDB breakpoints and disassemble?
Sorry English isn't my first language.
I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded.
I have found it weird how GDB behaves when there ...
- 16.3k
1
vote
1
answer
60
views
How are members of a Structure Type positioned on the stack?
Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
- 921
1
vote
2
answers
60
views
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol ...
- 16.3k
1
vote
0
answers
88
views
PowerPC executable doesn't show debugging symbols in Ghidra
I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box.
In Ghidra ...
- 239
0
votes
1
answer
126
views
How is padding size calculated for members of structure types?
Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
- 921
3
votes
1
answer
13k
views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
CommunityBot
- 1
1
vote
0
answers
124
views
dwarf: variable offset from base
I have a simple code:
int main()
{
int a = 4;
printf("%d\n", a);
a = 8;
if (a == 8)
printf("%d\n", a);
return 0;
}
DIEs for the function and variable:
<1><32a>: Abbrev ...
- 1,797
2
votes
0
answers
2k
views
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
- 121
0
votes
1
answer
112
views
Does the Radare Debugger support STABS?
From the wiki on Stabs
stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers.
Does Radare ...
- 8,919
4
votes
1
answer
230
views
Using debug symbols of an older exe for a newer exe
Sorry for the question if anything is wrong, I'm new to StackOverflow. I have DWARF debug file of a C++ Mac program of version (i.e. 1.1). Is there any way to use this debug information in a newer ...
CommunityBot
- 1
0
votes
1
answer
1k
views
PE: Strange entry in debug directory (Type: 0xc)
Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here.
I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2.
Now I have ...
- 1,550
2
votes
1
answer
347
views
Is all debug information of VS-compiled PE files contained in an external PDB file?
I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files?
Is it safe to assume that all Visual Studio compiled PE files have all debug ...
- 851
6
votes
0
answers
2k
views
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:
a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
a2ed8: e1a04000 mov ...
- 161
2
votes
2
answers
2k
views
Obtain .exe/.dll/.sys for a given .pdb file
If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
- 16.3k
3
votes
1
answer
3k
views
How to add standard symbolic constants with bitwise operators (like ORs)
I am working with IDA and I have the OpenProcess function receiving dwDesireAccess of 0x410:
According to MSDN we can see that 0x410 is the result of OR between two access rights:
...
- 456
3
votes
1
answer
528
views
Symbols visible in EXE file without PDB
I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
- 36.4k
1
vote
0
answers
1k
views
Symbols could not be loaded for win32k drivers
I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
- 153
3
votes
2
answers
1k
views
How to extract debug information from a DOS executable compiled with Watcom C/C++?
I have a DOS executable which has been compiled with Watcom C/C++ 10.0.
That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
- 36.4k
3
votes
2
answers
2k
views
Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?
After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.188869 (modified 25/5/15) to 6.1.7601.18933 (modified 15/07/2015).
Since then, !peb, !teb, !address ...
CommunityBot
- 1
5
votes
1
answer
2k
views
Load IE symbols in Immunity Debugger
I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll
What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is ...
- 6,040
1
vote
1
answer
137
views
Chrome Vulnerability Issue
My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
- 20.7k
0
votes
1
answer
4k
views
IDAPython load PDB-file of analysed binary
in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File).
I know how to load a PDB-File via GUi but I need this scripted.
Has ...
- 18.9k
1
vote
1
answer
2k
views
How does IDA pro generate function names?
I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
- 346
5
votes
1
answer
4k
views
IDA Can't load symbols "DIA: No such interface supported"
I'm trying to load symbols for a dll with IDA pro.
My _NT_SYMBOL_PATH is SRV*c:\symbols*http://msdl.microsoft.com/download/symbols .
I put DBGTOOLS = "C:\\Program Files (x86)\\Windows Kits\\8.1\\...
- 18.9k
12
votes
1
answer
639
views
Are those code snippets and file paths in a C++ binary some sort of standard debug information?
This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.
Is this something standard? (Is this RTTI)
If so, how is this called?
Are there ...
- 2,354
6
votes
0
answers
228
views
How to find the symbol table in a TI DSP. (TMS320C5510)
That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
- 401
12
votes
5
answers
6k
views
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is:
Unable to enumerate locals, HRESULT 0x80004005
...
- 3,208
5
votes
1
answer
816
views
SQL Server not downloading symbols from the symbol server, even though SymInitialize has the symserver in its path
EDIT Clarified, I meant the extended exent ringbugger stacktraces described by Jonathan Kehayias.
I recently discovered it was possible to get link.exe, dumpbin.exe, etc to download symbols from a ...
CommunityBot
- 1
4
votes
1
answer
265
views
Safari windows debugging symbols
Apple developer network site has a small guide about setting up debugging symbols server for Safari browser on Windows. But it doesn't work. First, the link to actual symbols server
gets redirected ...
- 446