I want get from address name function. About SymFromAddr

Index > Windows > I want get from address name function. About SymFromAddr

Author

Thread

Roman

Joined: 21 Apr 2012
Posts: 2092

Roman 10 Aug 2026, 06:48

How using SymFromAddr(from dbghelp.dll) ?

I try but get EAX=0

Code:

;32 bits program. 
struct SYMBOL_INFO
     SizeOfStruct        dd 0;ULONG
     TypeIndex           dd 0;ULONG
     Reserved            dq 0, 0
     Index               dd 0;ULONG
     Size                dd 0;ULONG
     ModBas              dq 0;ULONG64
     Flags               dd 0;ULONG
     Value               dq 0 ;ULONG64
     Address             dq 0 ;ULONG64
     Register            dd 0;ULONG
     Scope               dd 0;ULONG
     Tag                 dd 0;ULONG
     NameLen             dd 0;ULONG
     MaxNameLen          dd 0;ULONG
     Name                db 64 dup(0) ;char
 ends  

zbuf SYMBOL_INFO

mov dword [zbuf],sizeof.SYMBOL_INFO
        mov dword [zbuf+SYMBOL_INFO.MaxNameLen],63
        mov ebx,[MessageBox]
        invoke GetCurrentProcessId
        invoke SymFromAddr,eax,ebx,0,0,zbuf ;ret EAX=0. if ok EAX=1

DWORD64 dwDisplacement = 0;
DWORD64 dwAddress = SOME_ADDRESS;

char buffer[sizeof(SYMBOL_INFO) + MAX_SYM_NAME * sizeof(TCHAR)];
PSYMBOL_INFO pSymbol = (PSYMBOL_INFO)buffer;

pSymbol->SizeOfStruct = sizeof(SYMBOL_INFO);
pSymbol->MaxNameLen = MAX_SYM_NAME;

if (SymFromAddr(hProcess, dwAddress, &dwDisplacement, pSymbol))
{
// SymFromAddr returned success
}
else
{
// SymFromAddr failed
DWORD error = GetLastError();
printf("SymFromAddr returned error : %d\n", error);
}

Last edited by Roman on 10 Aug 2026, 08:22; edited 3 times in total

10 Aug 2026, 06:48

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 21028
Location: In your JS exploiting you and your system

revolution 10 Aug 2026, 06:54

Probably the structure is not correct.

Code:

struct SYMBOL_INFO
     SizeOfStruct        dd 0;ULONG
     TypeIndex           dd 0;ULONG
     Reserved            dq 0, 0
     Index               dd 0;ULONG
     Size                dd 0;ULONG
     ModBas              dq 0;ULONG64
     Flags               dd 0;ULONG
     padding             dd ?        ; <---------- make next qword aligned
     Value               dq 0 ;ULONG64
     Address             dq 0 ;ULONG64
     Register            dd 0;ULONG
     Scope               dd 0;ULONG
     Tag                 dd 0;ULONG
     NameLen             dd 0;ULONG
     MaxNameLen          dd 0;ULONG
     Name                db 64 dup(0) ;char
 ends

C code aligns each structure member individually.

10 Aug 2026, 06:54

Roman

Joined: 21 Apr 2012
Posts: 2092

Roman 10 Aug 2026, 07:57

And how get hProcess ?
using GetCurrentProcessId or GetCurrentProcess ? Or some else ?

10 Aug 2026, 07:57

Roman

Joined: 21 Apr 2012
Posts: 2092

Roman 10 Aug 2026, 08:54

Code:

;size 88 bytes
struct SYMBOL_INFO
     SizeOfStruct        dd 0;ULONG
     TypeIndex           dd 0;ULONG
     Reserved            dq 0, 0
     Index               dd 0;ULONG
     Size                dd 0;ULONG
     ModBas              dq 0;ULONG64
     Flags               dd 0;ULONG
     padding             dd ?        ; <---------- make next qword aligned
     Value               dq 0 ;ULONG64
     Address             dq 0 ;ULONG64
     Register            dd 0;ULONG
     Scope               dd 0;ULONG
     Tag                 dd 0;ULONG
     NameLen             dd 0;ULONG
     MaxNameLen          dd 0;ULONG
     pad2                      dd 0
 ends

10 Aug 2026, 08:54

Roman

Joined: 21 Apr 2012
Posts: 2092

Roman 10 Aug 2026, 12:55

SymFromAddr get from pdb file.
Very bad.

10 Aug 2026, 12:55

bitRAKE

Joined: 21 Jul 2003
Posts: 4562
Location: vpcmpistri

bitRAKE 10 Aug 2026, 15:53

How have you configured the symbol server and loaded modules? hProcess can be a "key" (FALSE) or a live, readable process handle (TRUE) -- depending on SymInitialize(h, path, FALSE/TRUE).

Edit: I added an example of correct (dbghelp.dll + symsrv.dll) output. Rather than scan live loaded modules, this program loads modules independent of the executable. So, it makes very clear bad configurations and every search location.

Debugging Tools for Windows has a correctly paired dbghelp.dll and symsrv.dll -- they tend to update as frequently as Windows builds, imho.

10 Aug 2026, 15:53

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum