Hot answers tagged

2

The recent updates to the Mach-O format (the LC_DYLD_INFO_ONLY command) have an option of encoding the export symbol information as a trie structure. In such case it's possible that the symbol name does not appear as an exact string in the file. However, ELF does not use such encoding so normally all symbols must be present as-is in the binary. What seems ...


1

I think Diaphora supports cross architecture binary diffing so that could be an additional option to try.


1

Ghidra has a version tracking tool with lots of analysis options to compare features of the binaries to name things. I have used it on ppc->mips firmware. I started off with a pretty RE'ed PPC image and a new MIPS firmware with the default tool in ghidra, I named a handful of functions in the new one. Opening them up in the version tracker tool, I ...


1

official way is as pointed out by other answers use symchk.exe from windbg installation but you can also fetch it by putting together few dbghelp and winsock functions find below a poc that uses wget.exe #include <stdio.h> #include <windows.h> #include <dbghelp.h> #pragma comment(lib,"dbghelp.lib") #pragma comment(lib,"user32....


1

I fixed it by Setting the environment variable _NT_SYMBOL_PATH=srv*c:\pdb_cache*http://msdl.microsoft.com/download/symbols then tick the "auto load PDB files" in Debugger Options


1

since this has nothing to do with original query and is an experiment of sorts with the labeller windbg extension that i edited in in my first answer i am adding this as a new answer and not editing my original answer since the question of performance of AddSyntheticSymbol for bulk Addition Came up i cooked up a small 6 figure long windbg script file that i ...


Only top voted, non community-wiki answers of a minimum length are eligible