Questions tagged [debugging-symbols]

Extra information added to help for debugging purpose. It gathers information about each variable, type, procedure, etc, and link the assembly code to source code. Usual debugging-symbols formats includes DWARF, stabs, PDB ...

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

Is there a way to refresh PDB read during file loading with Odbg 1.10?

Is it possible to make OllyDbg reload PDB symbols on each load of file? ie, refresh. Just like the option Analysis -> Remove object scan from module but rather automatic on file reload.
1
vote
1answer
1k views

IDA 7.0 (free) fails to load symbols with message "DWARF: Cannot determine location of DWARF info" during debugging

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM: Then loaded a test PE file and started debugging it (using Local Windows Debugger): ...
1
vote
1answer
51 views

analyze how data is read in android usb device

I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
3
votes
2answers
1k views

GHIDRA: How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
2
votes
1answer
473 views

Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?

I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
1
vote
1answer
475 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
2
votes
1answer
279 views

WinDBG doesn't resolve function names when debugging kernel module

I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically). Here is a picture ...
0
votes
1answer
358 views

Can I force GDB breakpoints and disassemble?

Sorry English isn't my first language. I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded. I have found it weird how GDB behaves when there ...
1
vote
1answer
51 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
1
vote
2answers
51 views

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol ...
1
vote
0answers
51 views

PowerPC executable doesn't show debugging symbols in Ghidra

I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box. In Ghidra ...
0
votes
1answer
55 views

How is padding size calculated for members of structure types?

Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c here. All the way until the ...
2
votes
1answer
7k views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
1
vote
0answers
44 views

dwarf: variable offset from base

I have a simple code: int main() { int a = 4; printf("%d\n", a); a = 8; if (a == 8) printf("%d\n", a); return 0; } DIEs for the function and variable: <1><32a>: Abbrev ...
2
votes
0answers
1k views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
0
votes
1answer
91 views

Does the Radare Debugger support STABS?

From the wiki on Stabs stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers. Does Radare ...
4
votes
1answer
110 views

Using debug symbols of an older exe for a newer exe

Sorry for the question if anything is wrong, I'm new to StackOverflow. I have DWARF debug file of a C++ Mac program of version (i.e. 1.1). Is there any way to use this debug information in a newer ...
0
votes
1answer
788 views

PE: Strange entry in debug directory (Type: 0xc)

Microsoft describes the IMAGE_DEBUG_DIRECTORY structure here. I learned here that for recent VisualStudio-compiled binaries, the type is IMAGE_DEBUG_TYPE_CODEVIEW, i.e. the value is 0x2. Now I have ...
2
votes
1answer
254 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

I read here that some PE files have debug information baked into the PE file. Is this only the case for older PE files? Is it safe to assume that all Visual Studio compiled PE files have all debug ...
5
votes
0answers
1k views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
2
votes
2answers
1k views

Obtain .exe/.dll/.sys for a given .pdb file

If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
3
votes
1answer
2k views

How to add standard symbolic constants with bitwise operators (like ORs)

I am working with IDA and I have the OpenProcess function receiving dwDesireAccess of 0x410: According to MSDN we can see that 0x410 is the result of OR between two access rights: ...
3
votes
1answer
430 views

Symbols visible in EXE file without PDB

I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does ...
1
vote
0answers
1k views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
2
votes
2answers
762 views

How to extract debug information from a DOS executable compiled with Watcom C/C++?

I have a DOS executable which has been compiled with Watcom C/C++ 10.0. That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
2
votes
2answers
1k views

Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?

After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.188869 (modified 25/5/15) to 6.1.7601.18933 (modified 15/07/2015). Since then, !peb, !teb, !address ...
5
votes
1answer
2k views

Load IE symbols in Immunity Debugger

I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is ...
1
vote
1answer
130 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
0
votes
1answer
3k views

IDAPython load PDB-file of analysed binary

in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File). I know how to load a PDB-File via GUi but I need this scripted. Has ...
1
vote
1answer
2k views

How does IDA pro generate function names?

I am using IDA pro to decompile a series of applications. These applications share a common feature and what I have found is that in each decompilation each application shares the same set of ...
5
votes
1answer
4k views

IDA Can't load symbols "DIA: No such interface supported"

I'm trying to load symbols for a dll with IDA pro. My _NT_SYMBOL_PATH is SRV*c:\symbols*http://msdl.microsoft.com/download/symbols . I put DBGTOOLS = "C:\\Program Files (x86)\\Windows Kits\\8.1\\...
10
votes
1answer
563 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
5
votes
0answers
201 views

How to find the symbol table in a TI DSP. (TMS320C5510)

That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
11
votes
5answers
6k views

How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?

I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is: Unable to enumerate locals, HRESULT 0x80004005 ...
4
votes
1answer
783 views

SQL Server not downloading symbols from the symbol server, even though SymInitialize has the symserver in its path

EDIT Clarified, I meant the extended exent ringbugger stacktraces described by Jonathan Kehayias. I recently discovered it was possible to get link.exe, dumpbin.exe, etc to download symbols from a ...
4
votes
1answer
238 views

Safari windows debugging symbols

Apple developer network site has a small guide about setting up debugging symbols server for Safari browser on Windows. But it doesn't work. First, the link to actual symbols server gets redirected ...