Skip to content

Commit aec35a4

Browse files
hakrilhakril
committed
Added Symbol related sample output
1 parent e70c97c commit aec35a4

4 files changed

Lines changed: 95 additions & 0 deletions

File tree

‎docs/source/samples_output/debug_symbol_debugger.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
(cmd) python debug\symbol_debugger.py
2+
Namespace(dbghelp=None)
3+
Breakpoint triggered at: ntdll!LdrpInitializeProcess
4+
<SymbolInfoA name="LdrpInitializeProcess" start=0x77c676c0 tag=SymTagPublicSymbol>
5+
6+
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
7+
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
8+
9+
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
10+
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
11+
12+
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
13+
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
14+
Quitting
15+

‎docs/source/samples_output/debug_symbol_processsymdemo.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
(cmd) python debug\symbols\processsymdemo.py
2+
Namespace(dbghelp=None)
3+
Target is <WinProcess "notepad.exe" pid 14280 at 0x4e177b0>
4+
Some loaded modules are:
5+
* <SymbolModule name="notepad" type=SymDeferred pdb="" addr=0xc10000>
6+
* <SymbolModule name="ntdll" type=SymDeferred pdb="" addr=0x77bc0000>
7+
* <SymbolModule name="KERNEL32" type=SymDeferred pdb="" addr=0x77480000>
8+
9+
Resolving function <advapi32!CreateServiceEx>
10+
Symbol found !
11+
* __repr__: <SymbolInfoA name="CreateServiceEx" start=0x764647b0 tag=SymTagPublicSymbol>
12+
* __str__: advapi32!CreateServiceEx
13+
* addr: 0x764647b0
14+
* name: CreateServiceEx
15+
* fullname: advapi32!CreateServiceEx
16+
* module: <SymbolModule name="advapi32" type=SymPdb pdb="advapi32.pdb" addr=0x76440000>

‎docs/source/samples_output/debug_symbol_symsearch.txt‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
$ python64 debug\symbols\symsearch.py "CreateFile*" c:\windows\system32\kernelbase.dll
2+
Namespace(addr=0, dbghelp=None, file='c:\\windows\\system32\\kernelbase.dll', pattern='CreateFile*', tag=0)
3+
16 symbols found:
4+
* <SymbolInfoA name="CreateFileInternal" start=0x180024250 tag=SymTagFunction>
5+
* <SymbolInfoA name="CreateFileMappingFromApp" start=0x1800809d0 tag=SymTagFunction>
6+
* <SymbolInfoA name="CreateFileMoniker" start=0x180087e40 tag=SymTagFunction>
7+
* <SymbolInfoA name="CreateFile2" start=0x180074550 tag=SymTagFunction>
8+
* <SymbolInfoA name="CreateFileA" start=0x1800240d0 tag=SymTagFunction>
9+
* <SymbolInfoA name="CreateFileMappingNumaW" start=0x18002ca40 tag=SymTagFunction>
10+
* <SymbolInfoA name="CreateFileMapping2" start=0x1800fb6d0 tag=SymTagPublicSymbol>
11+
* <SymbolInfoA name="CreateFileInternal" start=0x180024250 tag=SymTagPublicSymbol>
12+
* <SymbolInfoA name="CreateFileMappingW" start=0x18002cd00 tag=SymTagPublicSymbol>
13+
* <SymbolInfoA name="CreateFileDowngrade_Win7" start=0x180082ff0 tag=SymTagPublicSymbol>
14+
* <SymbolInfoA name="CreateFileDowngrade_Vista" start=0x18007eba0 tag=SymTagPublicSymbol>
15+
* <SymbolInfoA name="CreateFileMappingFromApp" start=0x1800809d0 tag=SymTagPublicSymbol>
16+
* <SymbolInfoA name="CreateFile2" start=0x180074550 tag=SymTagPublicSymbol>
17+
* <SymbolInfoA name="CreateFileW" start=0x1800241d0 tag=SymTagPublicSymbol>
18+
* <SymbolInfoA name="CreateFileA" start=0x1800240d0 tag=SymTagPublicSymbol>
19+
* <SymbolInfoA name="CreateFileMappingNumaW" start=0x18002ca40 tag=SymTagPublicSymbol>
20+
21+
22+
$ python64 debug\symbols\symsearch.py "NtCreate*" c:\windows\system32\ntdll.dll --addr 0x42000000
23+
Namespace(addr=1107296256, dbghelp=None, file='c:\\windows\\system32\\ntdll.dll', pattern='NtCreate*', tag=0)
24+
47 symbols found:
25+
* <SymbolInfoA name="NtCreateProcessEx" start=0x4209ca00 tag=SymTagPublicSymbol>
26+
* <SymbolInfoA name="NtCreateIRTimer" start=0x4209d530 tag=SymTagPublicSymbol>
27+
* <SymbolInfoA name="NtCreateRegistryTransaction" start=0x4209d750 tag=SymTagPublicSymbol>
28+
* <SymbolInfoA name="NtCreateTimer" start=0x4209d810 tag=SymTagPublicSymbol>
29+
* <SymbolInfoA name="NtCreateKeyedEvent" start=0x4209d5d0 tag=SymTagPublicSymbol>
30+
* <SymbolInfoA name="NtCreateFile" start=0x4209cb00 tag=SymTagPublicSymbol>
31+
* <SymbolInfoA name="NtCreateSymbolicLinkObject" start=0x4209d7d0 tag=SymTagPublicSymbol>
32+
* <SymbolInfoA name="NtCreatePrivateNamespace" start=0x4209d6d0 tag=SymTagPublicSymbol>
33+
* <SymbolInfoA name="NtCreateKey" start=0x4209c400 tag=SymTagPublicSymbol>
34+
...

‎docs/source/samples_output/debug_symbol_virtsymdemo.txt‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
(cmd) python debug\symbols\virtsymdemo.py
2+
Namespace(dbghelp=None)
3+
Ntdll module is: <SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>
4+
* name = ntdll
5+
* addr = 0x420000
6+
* path = c:\windows\system32\ntdll.dll
7+
* type = <SYM_TYPE SymPdb(0x3L)>
8+
* pdb = d:\symbols\wntdll.pdb\3D038F31BBBF51C701937460DBAB1F531\wntdll.pdb
9+
10+
Resolving function <LdrLoadDll>
11+
Symbol found !
12+
* __repr__: <SymbolInfoA name="LdrLoadDll" start=0x464d30 tag=SymTagFunction>
13+
* __str__: ntdll!LdrLoadDll
14+
* addr: 0x464d30
15+
* name: LdrLoadDll
16+
* fullname: ntdll!LdrLoadDll
17+
* module: <SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>
18+
19+
Loading kernelbase
20+
Loaded modules are: [<SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>, <SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x1230000>]
21+
Looking up address: 0x1231242
22+
Symbol resolved !
23+
* __repr__: <SymbolInfoA name="__load_config_used" start=0x1231230 displacement=0x12 tag=SymTagPublicSymbol>
24+
* __str__: kernelbase!__load_config_used+0x12
25+
* start: 0x1231230
26+
* addr: 0x1231242
27+
* displacement: 0x12
28+
* name: __load_config_used
29+
* fullname: kernelbase!__load_config_used+0x12
30+
* module: <SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x1230000>

0 commit comments

Comments
 (0)