利用pdb获取未导出符号

来源：互联网发布：机车知乎编辑：程序博客网时间：2024/05/16 10:55
BOOL InitSymHandler(HANDLE hProc){CHAR SymPath[MAX_PATH], CurDir[MAX_PATH];GetCurrentDirectoryA(sizeof(CurDir) / sizeof(CurDir[0]), CurDir);SymSetOptions(SYMOPT_DEFERRED_LOADS|SYMOPT_EXACT_SYMBOLS|SYMOPT_CASE_INSENSITIVE|SYMOPT_UNDNAME);wsprintfA(SymPath, "SRV*%s\\Symbols*http://msdl.microsoft.com/download/symbols", CurDir);return SymInitialize(hProc, SymPath, FALSE);}BOOL LoadSymModule(HANDLE hProc, HMODULE hDll){CHAR szFile[MAX_PATH], SymFile[MAX_PATH];MODULEINFO ModInfo;GetModuleFileNameA(hDll, szFile, sizeof(szFile) / sizeof(szFile[0]));GetModuleInformation(hProc, hDll, &ModInfo, sizeof(ModInfo));if (SymGetSymbolFile(hProc, NULL, szFile, sfPdb, SymFile, MAX_PATH, SymFile, MAX_PATH)){return (SymLoadModule64(hProc, NULL, szFile, NULL, (ULONG_PTR)ModInfo.lpBaseOfDll, ModInfo.SizeOfImage) != 0);}return FALSE;}BOOL CALLBACK SymCallback(PSYMBOL_INFO lpSymInfo, ULONG SymbolSize, PVOID UserContext){if (lstrcmpA(lpSymInfo->Name, "PsGetNextProcess") == 0){DebugBreak();}return TRUE;}int _tmain(int argc, _TCHAR* argv[]){if (InitSymHandler(GetCurrentProcess())){HMODULE hDll = LoadLibraryEx(TEXT("ntoskrnl.exe"), NULL, DONT_RESOLVE_DLL_REFERENCES);if (LoadSymModule(GetCurrentProcess(), hDll)){SymEnumSymbols(GetCurrentProcess(), (ULONG_PTR)hDll, NULL, SymCallback, NULL);}FreeLibrary(hDll);SymCleanup(GetCurrentProcess());}getchar();return 0;}
0 0