@@ -535,6 +535,52 @@ The local debugger handles
535535* Standard breakpoint `` int3 ``
536536* Hardware Execution breakpoint `` DrX ``
537537
538+ ### Symbols
539+
540+ Classes around the Symbols APIs of ` dbghelp.dll ` are also implemented and can be used independently of the Debugger.
541+ The path of ` dbghelp.dll ` can also be given via the ` PFW_DBGHELP_PATH ` environment variable.
542+
543+
544+ ``` python
545+ # Python3
546+
547+ >> > from windows.debug import symbols
548+ >> > # symbols.set_dbghelp_path(MY_DBGHELP_PATH)
549+ >> > symbols.engine.options = 0 # Disable defered load
550+ >> > sh = symbols.VirtualSymbolHandler()
551+ >> > ntmod = sh.load_file(r " c:\w indows\s ystem32\n tdll. dll" , addr = 0x 420000 )
552+ >> > ntmod
553+ < SymbolModule name= " ntdll" type = SymPdb pdb= " ntdll.pdb" addr= 0x 420000>
554+ >> > ntmod.name
555+ ' ntdll'
556+ >> > ntmod.path
557+ ' c:\\ windows\\ system32\\ ntdll.dll'
558+ >> > ntmod.pdb
559+ ' c:\\ Symbols\\ ntdll.pdb\\ 8D5D5ED5D5B8AA609A82600C14E3004D1\\ ntdll.pdb'
560+ >> > sym = sh[" ntdll!LdrLoadDll" ]
561+ >> > sym
562+ < SymbolInfoW name= " LdrLoadDll" start= 0x 44a160 tag= SymTagFunction>
563+ >> > sym.fullname
564+ ' ntdll!LdrLoadDll'
565+ >> > hex (sym.addr)
566+ ' 0x44a160'
567+ >> > sh.search(" ntdll!*CreateFile" )
568+ [< SymbolInfoW name=" EtwpCreateFile" start=0x 47d9ec tag=SymTagFunction> , < SymbolInfoW name=" EtwpCreateFile" start=0x 47d9ec tag=SymTagPublicSymbol> , < SymbolInfoW name=" NtCreateFile" start=0x 4c03e0 tag=SymTagPublicSymbol> , < SymbolInfoW name=" ZwCreateFile" start=0x 4c03e0 tag=SymTagPublicSymbol> , < SymbolInfoW name=" __imp_NtCreateFile" start=0x 55cb70 tag=SymTagPublicSymbol> ]
569+ # Some types exploration
570+ >> > sh.get_type(" ntdll!_PEB" )
571+ < SymbolType name= " _PEB" tag= _SymTagEnum.SymTagUDT(0x b )>
572+ >> > peb = _
573+ >> > peb = sh.get_type(" ntdll!_PEB" )
574+ >> > peb
575+ < SymbolType name= " _PEB" tag= _SymTagEnum.SymTagUDT(0x b )>
576+ >> > peb.size
577+ 2000
578+ >> > peb.children[:3 ]
579+ [< SymbolType name=" InheritedAddressSpace" tag=_SymTagEnum.SymTagData(0x 7 )> , < SymbolType name=" ReadImageFileExecOptions" tag=_SymTagEnum.SymTagData(0x 7 )> , < SymbolType name=" BeingDebugged" tag=_SymTagEnum.SymTagData(0x 7 )> ]
580+ >> > peb.children[2 ].offset
581+ 2
582+ ```
583+
538584### Other stuff (see doc / samples)
539585
540586- Network
0 commit comments