New answers tagged

2

Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system types (structures , enumerations) which is very useful for low level debugging. But even without types you can often guess a lot just from the function names.


2

without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc with symbols it would be like call dword ptr ds:[exitprocess] call foo32!blah jmp some-non-exported-address-that-was-named-by-symbol etc apart from names symbols provide typeinfo like push foo->blah instead of push [eax+60] also ...


Top 50 recent answers are included