正文
利用pdb获取未导出符号
小程序:扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序
【扫一扫了解最新限行尾号】
复制小程序
- BOOL InitSymHandler(HANDLE hProc)
- {
- CHAR SymPath[MAX_PATH], CurDir[MAX_PATH];
- GetCurrentDirectoryA(sizeof(CurDir) / sizeof(CurDir[0]), CurDir);
- SymSetOptions(SYMOPT_DEFERRED_LOADS|SYMOPT_EXACT_SYMBOLS|SYMOPT_CASE_INSENSITIVE|SYMOPT_UNDNAME);
- wsprintfA(SymPath, "SRV*%s\\Symbols*http://msdl.microsoft.com/download/symbols", CurDir);
- return SymInitialize(hProc, SymPath, FALSE);
- }
- BOOL LoadSymModule(HANDLE hProc, HMODULE hDll)
- {
- CHAR szFile[MAX_PATH], SymFile[MAX_PATH];
- MODULEINFO ModInfo;
- GetModuleFileNameA(hDll, szFile, sizeof(szFile) / sizeof(szFile[0]));
- GetModuleInformation(hProc, hDll, &ModInfo, sizeof(ModInfo));
- if (SymGetSymbolFile(hProc, NULL, szFile, sfPdb, SymFile, MAX_PATH, SymFile, MAX_PATH))
- {
- return (SymLoadModule64(hProc, NULL, szFile, NULL, (ULONG_PTR)ModInfo.lpBaseOfDll, ModInfo.SizeOfImage) != 0);
- }
- return FALSE;
- }
- BOOL CALLBACK SymCallback(PSYMBOL_INFO lpSymInfo, ULONG SymbolSize, PVOID UserContext)
- {
- if (lstrcmpA(lpSymInfo->Name, "PsGetNextProcess") == 0)
- {
- DebugBreak();
- }
- return TRUE;
- }
- int _tmain(int argc, _TCHAR* argv[])
- {
- if (InitSymHandler(GetCurrentProcess()))
- {
- HMODULE hDll = LoadLibraryEx(TEXT("ntoskrnl.exe"), NULL, DONT_RESOLVE_DLL_REFERENCES);
- if (LoadSymModule(GetCurrentProcess(), hDll))
- {
- SymEnumSymbols(GetCurrentProcess(), (ULONG_PTR)hDll, NULL, SymCallback, NULL);
- }
- FreeLibrary(hDll);
- SymCleanup(GetCurrentProcess());
- }
- getchar();
- return 0;
- }
jpg改rar