🔒 Locked

SymFromAddr does not work...

Started by Idov Jun 11, 2010 at 3:09 AM 4 replies 10.6k views

Original Post

Jun 11, 2010 at 3:09 AM

Hi!

I'm trying to get the symbols of a certain process by using the SymFromAddr method but even though I initialized it and as far as I know I use as I should, it keeps returning false...

this is my code:

first I initialize:

bool ok = SymInitialize(m_processHandle, NULL, FALSE);

and then I do this:

	char buffer[sizeof(SYMBOL_INFO) + MAX_SYM_NAME * sizeof(TCHAR)];		memset(&buffer, 0,sizeof(SYMBOL_INFO) + MAX_SYM_NAME * sizeof(TCHAR));		PSYMBOL_INFO pSymbol = (PSYMBOL_INFO)buffer;		pSymbol->SizeOfStruct = sizeof(SYMBOL_INFO);		pSymbol->MaxNameLen = MAX_SYM_NAME;		bool ok = SymFromAddr(m_processHandle, m_stackframe.AddrPC.Offset, &displacement, pSymbol);

Does anybody know what's wrong with it?
thanks :)

Evil Steve

382

Evil Steve

Jun 11, 2010 at 3:15 AM

What does GetLastError() return when SymFromAddr() fails?

Here's code I use (Which works), using SymGetSymFromAddr64:

// Get function nameunsigned char byBuffer[sizeof(IMAGEHLP_SYMBOL64) + cnBufferSize];IMAGEHLP_SYMBOL64* pSymbol = (IMAGEHLP_SYMBOL64*)byBuffer;DWORD64 dwDisplacement;memset(pSymbol, 0, sizeof(IMAGEHLP_SYMBOL64) + cnBufferSize);pSymbol->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL64);pSymbol->MaxNameLength = cnBufferSize;if(!SymGetSymFromAddr64(GetCurrentProcess(), nPC, &dwDisplacement, pSymbol))   strcpy(szFunc, "??");

Source

Idov

Author

Idov

Jun 11, 2010 at 6:25 AM

Quote:
Original post by Evil Steve
What does GetLastError() return when SymFromAddr() fails?

Here's code I use (Which works), using SymGetSymFromAddr64:
*** Source Snippet Removed ***
Source

It didn't work for me. I'm trying to run it on a different process, I get its handle with OpenProcess(PROCESS_ALL_ACCESS, TRUE, pid).

GetLastError() returns 126.

Evil Steve

382

Evil Steve

Jun 11, 2010 at 6:41 AM

Error code 126 is "The specified module could not be found." Where is the .pdb file for the process you're trying to debug? I'd guess that it can't find it (You could verify with Process Monitor, and see what file it can't find).

EDIT: The MSDN has information on where it searches for symbols.

[Edited by - Evil Steve on June 11, 2010 6:41:59 AM]

adeyblue

Jun 11, 2010 at 11:22 AM

Do you load the file with SymLoadModuleEx? It won't do it automatically since you told it not to (the last parameter to SymInitialize), so if you haven't that'd be the easiest way to cause that error.

Idov

Author

Idov

Jun 11, 2010 at 12:50 PM

Quote:
Original post by adeyblue
Do you load the file with SymLoadModuleEx? It won't do it automatically since you told it not to (the last parameter to SymInitialize), so if you haven't that'd be the easiest way to cause that error.

YES! THAT'S IT!
... I could swear I tried putting there "TRUE" but maybe I didn't...

thanks to both of you :)

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.