14

It has the fingerprint of an assert: it's called directly after a test; it uses a number -- probably a source line number --, a string which points to a file name -- the source file -- and a string that describes an error condition; it does not return. (Can be inferred because the inspected value would lead to an erronous situation if the called function ...


13

This is doable in WinDbg, but the syntax isn't the greatest. The other answers are probably better if you're just looking to get a result quickly. That said, here's how you'd do it. RegOpenKeyExW is an stdcall function, and it looks like you're on a 32-bit version of Windows, so when you enter the function the first argument will be at ESP+4, the second at ...


6

Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it. Go to Debug menu -> Debugging Symbol Options. Provide the local path to the symbol files or to a symbol server. UPDATE If ImmDbg successfully loaded the pdb symbol for the specified file, you would get a message in the logs ...


5

You could create a bitfield enum. Since the enum containing PROCESS_VM_READ already exists in the MSSDK type library, we are going to copy that and modify it to become a bitfield. Go to the enums subview, then right click and Add enum... (press Insert on Windows). Click Add standard enum by symbol name. Find PROCESS_VM_READ, then click OK. A new enum ...


5

dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. However, since it's not easy to narrow down the classes that may be possibly casted, in practice the compiler emits RTTI for all polymorphic classes (i.e. those ...


5

I have had hands down the best experiences with PaiMei, or in particular PyDbg for these purposes. The book "Grayhat Python" brought it to my attention and I decided to give it a try. The script Here's a somewhat generic skeleton I've been using in my dynamic analysis (dynamic-analysis) efforts. I have adjusted it so it'll hook the Unicode version of the ...


5

I finally solved my problem. DIA stands for Debug Interface Access and is the component used to correctly read PDB files. The msdia90.dll used doesn't seem to have been installed with the VS 2013 redistributables. I had to install the 2008 redistributables to get the correct dll. I solved my problem thanks to http://download.tuxfamily.org/...


4

With OllyDbg you can do it like this F:\odbg110>regedit & tasklist /fi "imagename eq rege*" Image Name PID Session Name Session# Mem Usage ========================= ====== ================ ======== ============ regedit.exe 2820 Console 0 2,512 K F:\odbg110>ollydbg -P 2820 F:\odbg110&...


4

I am a bit confused by the title of your question SQL Server or for that matter any other application apart from WinDbg or special symbol retrievers wont be able to download symbols from ms symbol servers Did you mean you used symchk on the sqlserver.exe as mentioned in the blog you linked A simple method to get symbols for any application is to set ...


4

You can use PDB downloader which doesn’t require any installation https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader. Or you could use its source below to see how you could recreate with PowerShell or some other method. https://github.com/rajkumar-rangaraj/PDB-Downloader You can also just copy the WinDBg files from a machine where it’s ...


3

The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a typedef named Char, which redirects to 0x29b7, which is indeed char (represented as base type signed char). <1><3451>: Abbrev Number: 11 (...


3

I've seen 4 naming conventions being used: vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address within the binary. sub_HHHHHH() when decompiling x86/64 binaries (i.e.: for Windows, OSX) with the actual address on the name _name/__name() for functions IDA is ...


3

you probably can't use I as-is but there some possibilities: apply symbols to the version 1.1 then use some binary diffing/porting tool to find the matching functions in the version 1.5. if you don't have the old binary, just dump the symbols and use the information in the binary (strings etc.) to find the matching functions and rename them. the addresses ...


3

If you check winnt.h from the latest Windows 10 SDK you can find rest of the values there: #define IMAGE_DEBUG_TYPE_UNKNOWN 0 #define IMAGE_DEBUG_TYPE_COFF 1 #define IMAGE_DEBUG_TYPE_CODEVIEW 2 #define IMAGE_DEBUG_TYPE_FPO 3 #define IMAGE_DEBUG_TYPE_MISC 4 #define IMAGE_DEBUG_TYPE_EXCEPTION 5 #...


3

Old versions of link.exe supported the /debugtype argument that used these options: /debugtype:coff use COFF format /debugtype:cv use CodeView or Program Database format (depends on /pdb option) /debugtype:both use both COFF and CodeView/Program Database formats According to the MSDN docs for Visual Studio 2008's linker, that option was no ...


3

the binaries (exe , sys , dll ) are fetched from ms symbol servers by their time_date_stamp and size the windbg command !chkimg normally fetches the binaries for minidumps and it uses SymFindFileInPath Function which takes three ids which are different for pdbs and binaries you may take a look at the Remarks Section Of the function for the id definition ...


3

Download Rohitab's API Monitor and set the API capture filter on just RegOpenKeyEx. Below are just example screenshots of how it works and the information it provides. From what you described, this should do exactly what you need.


3

gdb is primarily a Source Level Debugger to set a bp on an address instead of symbol use * (gdb) break main Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4. (gdb) break *0x100401094 Note: breakpoint 1 also set at pc 0x100401094. Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4. (gdb) you can disassemble using address, length at any arbitrary ...


2

Chrome != Chromium. Google makes several changes to the Chromium code base before building Chrome. This may be one of the changes. Nonetheless, the snapshot for the 41.0.2272.89 version of Chromium can be found here: https://chromium.googlesource.com/chromium/src.git/+/41.0.2272.89 You can see in https://chromium.googlesource.com/chromium/src.git/+/41.0....


2

According to the SDK, the PDB loader is implemented as an IDA plugin (see the SDK, e.g: \idasdk67\plugins\pdb). The plugin name is "pdb", so you can call the plugin directly, like this: idaapi.load_and_run_plugin("pdb", call_code) Where call_code is an enum defined in \idasdk67\plugins\pdb\common.h, 0, 1 and 2 are already defined and will ask for user ...


2

Although it doesn't support breakpoints, Process Monitor is an excellent tool to monitor registry access. Using Filters you can easily choose which keys you want to include, exclude, highlight etc. It also allows you to view the stack trace of any event. Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, ...


2

OpenWatcom includes the wdump utility which can dump the debug info (if it's present).


2

without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc with symbols it would be like call dword ptr ds:[exitprocess] call foo32!blah jmp some-non-exported-address-that-was-named-by-symbol etc apart from names symbols provide typeinfo like push foo->blah instead of push [eax+60] also ...


2

From my cross-site answer: You could assume that the types in ntdll have not changed so much. This would allow you to take an older version of wntdll.pdb and the new version of ntdll.dll and apply ChkMatch -m to it. This will copy the timestamp and checksum from the DLL to the PDB. After you did that (in an empty folder), replace the existing wntdll.pdb in ...


2

18933 builds have applied various security updates and the symbols on the symbol server are mangled. This is why WinDbg cannot perform those commands or list those structures for you. If this is a debug machine, I would recommend reverting these updates temporarily.


2

It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is: Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set its value like SRV*\C:\Symbols*http://msdl.microsoft.com/download/symbols The next time you launch IDA, it should tell you when to load MS symbols from the ...


2

This can easily be achieved with radare2. I have this version installed [rese] r2 -v radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9 commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 build: 2020-07-28__11:41:47 Enable .init_array in a program as such #include <stdio.h> static void f1(void) __attribute__((constructor)); static void f2(...


2

Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system types (structures , enumerations) which is very useful for low level debugging. But even without types you can often guess a lot just from the function names.


1

The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. _IO_write_ptr is at offset 40, _IO_write_end is at offset 48 and and _IO_buf_base is at offset 56. The debug information for _IO_write_end is bigger than the ...


1

I fixed it by Setting the environment variable _NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols then tick the "auto load PDB files" in Debugger Options


Only top voted, non community-wiki answers of a minimum length are eligible