@@ -535,6 +535,52 @@ The local debugger handles
535
535
* Standard breakpoint `` int3 ``
536
536
* Hardware Execution breakpoint `` DrX ``
537
537
538
+ ### Symbols
539
+
540
+ Classes around the Symbols APIs of ` dbghelp.dll ` are also implemented and can be used independently of the Debugger.
541
+ The path of ` dbghelp.dll ` can also be given via the ` PFW_DBGHELP_PATH ` environment variable.
542
+
543
+
544
+ ``` python
545
+ # Python3
546
+
547
+ >> > from windows.debug import symbols
548
+ >> > # symbols.set_dbghelp_path(MY_DBGHELP_PATH)
549
+ >> > symbols.engine.options = 0 # Disable defered load
550
+ >> > sh = symbols.VirtualSymbolHandler()
551
+ >> > ntmod = sh.load_file(r " c:\w indows\s ystem32\n tdll. dll" , addr = 0x 420000 )
552
+ >> > ntmod
553
+ < SymbolModule name= " ntdll" type = SymPdb pdb= " ntdll.pdb" addr= 0x 420000>
554
+ >> > ntmod.name
555
+ ' ntdll'
556
+ >> > ntmod.path
557
+ ' c:\\ windows\\ system32\\ ntdll.dll'
558
+ >> > ntmod.pdb
559
+ ' c:\\ Symbols\\ ntdll.pdb\\ 8D5D5ED5D5B8AA609A82600C14E3004D1\\ ntdll.pdb'
560
+ >> > sym = sh[" ntdll!LdrLoadDll" ]
561
+ >> > sym
562
+ < SymbolInfoW name= " LdrLoadDll" start= 0x 44a160 tag= SymTagFunction>
563
+ >> > sym.fullname
564
+ ' ntdll!LdrLoadDll'
565
+ >> > hex (sym.addr)
566
+ ' 0x44a160'
567
+ >> > sh.search(" ntdll!*CreateFile" )
568
+ [< SymbolInfoW name=" EtwpCreateFile" start=0x 47d9ec tag=SymTagFunction> , < SymbolInfoW name=" EtwpCreateFile" start=0x 47d9ec tag=SymTagPublicSymbol> , < SymbolInfoW name=" NtCreateFile" start=0x 4c03e0 tag=SymTagPublicSymbol> , < SymbolInfoW name=" ZwCreateFile" start=0x 4c03e0 tag=SymTagPublicSymbol> , < SymbolInfoW name=" __imp_NtCreateFile" start=0x 55cb70 tag=SymTagPublicSymbol> ]
569
+ # Some types exploration
570
+ >> > sh.get_type(" ntdll!_PEB" )
571
+ < SymbolType name= " _PEB" tag= _SymTagEnum.SymTagUDT(0x b )>
572
+ >> > peb = _
573
+ >> > peb = sh.get_type(" ntdll!_PEB" )
574
+ >> > peb
575
+ < SymbolType name= " _PEB" tag= _SymTagEnum.SymTagUDT(0x b )>
576
+ >> > peb.size
577
+ 2000
578
+ >> > peb.children[:3 ]
579
+ [< SymbolType name=" InheritedAddressSpace" tag=_SymTagEnum.SymTagData(0x 7 )> , < SymbolType name=" ReadImageFileExecOptions" tag=_SymTagEnum.SymTagData(0x 7 )> , < SymbolType name=" BeingDebugged" tag=_SymTagEnum.SymTagData(0x 7 )> ]
580
+ >> > peb.children[2 ].offset
581
+ 2
582
+ ```
583
+
538
584
### Other stuff (see doc / samples)
539
585
540
586
- Network
0 commit comments