symbol-parser.h File Reference

symbol parser headers More...

Go to the source code of this file.

Classes
struct	_SYMBOL_LOADED_MODULE_DETAILS
	Hold detail about the loaded modules. More...

Macros
#define	DoNotShowDetailedResult   TRUE

Typedefs
typedef struct _SYMBOL_LOADED_MODULE_DETAILS	SYMBOL_LOADED_MODULE_DETAILS
	Hold detail about the loaded modules.
typedef struct _SYMBOL_LOADED_MODULE_DETAILS *	PSYMBOL_LOADED_MODULE_DETAILS

Functions
	__declspec (dllimport) int pdbex_export(int argc
	__declspec (dllexport) VOID SymSetTextMessageCallback(PVOID handler)
BOOL	SymGetFileParams (const char *FileName, DWORD &FileSize)
	Get symbol file parameters.
BOOL	SymGetFileSize (const char *FileName, DWORD &FileSize)
	Get symbol file size.
VOID	SymShowSymbolInfo (UINT64 ModBase)
	Show symbol info.
BOOL CALLBACK	SymDisplayMaskSymbolsCallback (SYMBOL_INFO *SymInfo, ULONG SymbolSize, PVOID UserContext)
	Callback for showing and enumerating symbols.
BOOL CALLBACK	SymDeliverDisassemblerSymbolMapCallback (SYMBOL_INFO *SymInfo, ULONG SymbolSize, PVOID UserContext)
	Callback for delivering module!ObjectName to disassembler symbol map.
VOID	SymShowSymbolDetails (SYMBOL_INFO &SymInfo)
	Show symbols details.
const char *	SymTagStr (ULONG Tag)
	Interpret different tags for pdbs.
BOOLEAN	SymbolPdbDownload (std::string SymName, const std::string &GUID, const std::string &SymPath, BOOLEAN IsSilentLoad)
	download pdb file

Variables
char **	argv
char bool	is_struct
char bool void *	buffer_address
const char *	PdbFileName
const char const char *	CustomModuleName
CHAR *	FieldName
CHAR UINT32 *	FieldOffset
UINT64 *	TypeSize
PBOOLEAN	WasFound
char *	ResultPath
char *	PdbFilePath
char char *	GuidAndAgeDetails
char char BOOLEAN	Is32BitModule
UINT32	StoredLength
UINT32 BOOLEAN	DownloadIfAvailable
UINT32 BOOLEAN const char *	SymbolPath
UINT32 BOOLEAN const char BOOLEAN	IsSilentLoad
UINT64	Address
UINT64 BOOLEAN	IsStruct
UINT64 BOOLEAN PVOID	BufferAddress
UINT64 BOOLEAN PVOID const char *	AdditionalParameters
UINT32 *	SizeOfField
const char *	FiledOfStructName
const char PBOOLEAN	IsStructNamePointerOrNot
const char PBOOLEAN PBOOLEAN	IsFiledOfStructNamePointerOrNot
const char PBOOLEAN PBOOLEAN char **	NewStructOrTypeName
const char PBOOLEAN PBOOLEAN char UINT32 *	OffsetOfFieldFromTop

Detailed Description

symbol parser headers

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-05-29

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

DoNotShowDetailedResult

#define DoNotShowDetailedResult   TRUE

Typedef Documentation

PSYMBOL_LOADED_MODULE_DETAILS

typedef struct _SYMBOL_LOADED_MODULE_DETAILS * PSYMBOL_LOADED_MODULE_DETAILS

SYMBOL_LOADED_MODULE_DETAILS

typedef struct _SYMBOL_LOADED_MODULE_DETAILS SYMBOL_LOADED_MODULE_DETAILS

Hold detail about the loaded modules.

Function Documentation

__declspec() [1/2]

__declspec

(

dllexport

)

{
    UNREFERENCED_PARAMETER(RegistryPath);
    return STATUS_SUCCESS;
}

__declspec() [2/2]

__declspec

(

dllimport

)

SymbolPdbDownload()

BOOLEAN SymbolPdbDownload	(	std::string	SymName,
		const std::string &	GUID,
		const std::string &	SymPath,
		BOOLEAN	IsSilentLoad )

download pdb file

Parameters

BufferToStoreDetails	Pointer to a buffer to store the symbols details this buffer will be allocated by this function and needs to be freed by caller
StoredLength	The length that stored on the BufferToStoreDetails
SymPath	The path of symbols
IsSilentLoad	Download without any message

return BOOLEAN

{
    vector<string> SplitedSymPath = Split(SymPath, '*');
    if (SplitedSymPath.size() < 2)
        return FALSE;
    if (SplitedSymPath[1].find(":\\") == string::npos)
        return FALSE;
    if (SplitedSymPath[2].find("http:") == string::npos && SplitedSymPath[2].find("https:") == string::npos)
        return FALSE;
 
    string SymDir            = SplitedSymPath[1];
    string SymDownloadServer = SplitedSymPath[2];
    string DownloadURL       = SymDownloadServer + "/" + SymName + "/" + GUID + "/" + SymName;
    string SymFullDir        = SymDir + "\\" + SymName + "\\" + GUID + "\\";
    if (!CreateDirectoryRecursive(SymFullDir))
    {
        if (!IsSilentLoad)
        {
            ShowMessages("err, unable to create sympath directory '%s'\n", SymFullDir.c_str());
        }
        return FALSE;
    }
 
    if (!IsSilentLoad)
    {
        ShowMessages("downloading symbol '%s'...", SymName.c_str());
    }
 
    HRESULT Result = URLDownloadToFileA(NULL, DownloadURL.c_str(), (SymFullDir + "\\" + SymName).c_str(), 0, NULL);
 
    if (Result == S_OK)
    {
        if (!IsSilentLoad)
        {
            ShowMessages("\tdownloaded\n");
        }
        return TRUE;
    }
    else
    {
        if (!IsSilentLoad)
        {
            ShowMessages("\tcould not be downloaded (%x) \n", Result);
        }
    }
 
    return FALSE;
}

SymDeliverDisassemblerSymbolMapCallback()

BOOL CALLBACK SymDeliverDisassemblerSymbolMapCallback	(	SYMBOL_INFO *	SymInfo,
		ULONG	SymbolSize,
		PVOID	UserContext )

Callback for delivering module!ObjectName to disassembler symbol map.

Parameters

SymInfo
SymbolSize
UserContext

Returns

BOOL

{
    if (SymInfo != 0 && g_SymbolMapForDisassembler != NULL)
    {
        //
        // Call the remote callback
        //
        g_SymbolMapForDisassembler(SymInfo->Address, g_CurrentModuleName, SymInfo->Name, SymInfo->Size);
    }
 
    //
    // Continue enumeration
    //
    return TRUE;
}

SymDisplayMaskSymbolsCallback()

BOOL CALLBACK SymDisplayMaskSymbolsCallback	(	SYMBOL_INFO *	SymInfo,
		ULONG	SymbolSize,
		PVOID	UserContext )

Callback for showing and enumerating symbols.

Parameters

SymInfo
SymbolSize
UserContext

Returns

BOOL

{
    if (SymInfo != 0)
    {
        SymShowSymbolDetails(*SymInfo);
    }
 
    //
    // Continue enumeration
    //
    return TRUE;
}

SymGetFileParams()

BOOL SymGetFileParams	(	const char *	FileName,
		DWORD &	FileSize )

Get symbol file parameters.

Parameters

FileName
BaseAddr
FileSize

Returns

BOOL

{
    //
    // Check parameters
    //
    if (FileName == 0)
    {
        return FALSE;
    }
 
    //
    // Determine the extension of the file
    //
    char FileExt[_MAX_EXT] = {0};
 
    _splitpath(FileName, NULL, NULL, NULL, FileExt);
 
    //
    // Is it .PDB file?
    //
    if (strcmp(FileExt, (".pdb")) == 0 || strcmp(FileExt, (".PDB")) == 0)
    {
        //
        // Yes, it is a .PDB file
        // Determine its size, and use a dummy base address
        //
 
        if (!SymGetFileSize(FileName, FileSize))
        {
            return FALSE;
        }
    }
    else
    {
        //
        // It is not a .PDB file
        // Base address and file size can be 0
        //
        FileSize = 0;
        return FALSE;
    }
 
    return TRUE;
}

SymGetFileSize()

BOOL SymGetFileSize	(	const char *	FileName,
		DWORD &	FileSize )

Get symbol file size.

Parameters

FileName
FileSize

Returns

BOOL

{
    //
    // Check parameters
    //
    if (FileName == 0)
    {
        return FALSE;
    }
 
    //
    // Open the file
    //
    HANDLE hFile = CreateFileA(FileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
 
    if (hFile == INVALID_HANDLE_VALUE)
    {
        ShowMessages("err, unable to open symbol file (%x)\n", GetLastError());
        return FALSE;
    }
 
    //
    // Obtain the size of the file
    //
    FileSize = GetFileSize(hFile, NULL);
 
    if (FileSize == INVALID_FILE_SIZE)
    {
        ShowMessages("err, unable to get symbol file size (%x)\n", GetLastError());
 
        //
        // and continue ...
        //
    }
 
    //
    // Close the file
    //
    if (!CloseHandle(hFile))
    {
        ShowMessages("err, unable to close symbol file (%x)\n", GetLastError());
 
        //
        // and continue ...
        //
    }
 
    return (FileSize != INVALID_FILE_SIZE);
}

SymShowSymbolDetails()

VOID SymShowSymbolDetails

(

SYMBOL_INFO &

SymInfo

)

Show symbols details.

Parameters

SymInfo

Returns

VOID

{
    if (g_CurrentModuleName == NULL)
    {
        //
        // Name Address
        //
        ShowMessages("%s ", SymSeparateTo64BitValue(SymInfo.Address).c_str());
    }
    else
    {
        //
        // Module!Name Address
        //
        ShowMessages("%s  %s!", SymSeparateTo64BitValue(SymInfo.Address).c_str(), g_CurrentModuleName);
    }
 
    //
    // Name
    //
    ShowMessages("%s\n", SymInfo.Name);
 
#ifndef DoNotShowDetailedResult
 
    //
    // Size
    //
    ShowMessages(" size: %u", SymInfo.Size);
 
    //
    // Kind of symbol (tag)
    //
    ShowMessages(" symbol: %s  ", SymTagStr(SymInfo.Tag));
 
#endif // !DoNotShowDetailedResult
}

SymShowSymbolInfo()

VOID SymShowSymbolInfo

(

UINT64

ModuleBase

)

Show symbol info.

Parameters

ModuleBase

Returns

VOID

{
    //
    // Get module information
    //
    IMAGEHLP_MODULE64 ModuleInfo;
 
    memset(&ModuleInfo, 0, sizeof(ModuleInfo));
 
    ModuleInfo.SizeOfStruct = sizeof(ModuleInfo);
 
    BOOL Ret = SymGetModuleInfo64(GetCurrentProcess(), ModuleBase, &ModuleInfo);
 
    if (!Ret)
    {
        ShowMessages("err, unable to get symbol file information (%x)\n",
                     GetLastError());
        return;
    }
 
    //
    // Display information about symbols
    // Kind of symbols
    //
    switch (ModuleInfo.SymType)
    {
    case SymNone:
        ShowMessages("no symbols available for the module\n");
        break;
 
    case SymExport:
        ShowMessages("loaded symbols: Exports\n");
        break;
 
    case SymCoff:
        ShowMessages("loaded symbols: COFF\n");
        break;
 
    case SymCv:
        ShowMessages("loaded symbols: CodeView\n");
        break;
 
    case SymSym:
        ShowMessages("loaded symbols: SYM\n");
        break;
 
    case SymVirtual:
        ShowMessages("loaded symbols: Virtual\n");
        break;
 
    case SymPdb:
        ShowMessages("loaded symbols: PDB\n");
        break;
 
    case SymDia:
        ShowMessages("loaded symbols: DIA\n");
        break;
 
    case SymDeferred:
 
        //
        // not actually loaded
        //
        ShowMessages("loaded symbols: Deferred\n");
        break;
 
    default:
        ShowMessages("loaded symbols: Unknown format\n");
        break;
    }
 
    //
    // Image name
    //
    if (ModuleInfo.ImageName[0] != '\0')
    {
        ShowMessages("image name: %s\n", ModuleInfo.ImageName);
    }
 
    //
    // Loaded image name
    //
    if (ModuleInfo.LoadedImageName[0] != '\0')
    {
        ShowMessages("loaded image name: %s\n", ModuleInfo.LoadedImageName);
    }
 
    //
    // Loaded PDB name
    //
    if (ModuleInfo.LoadedPdbName[0] != '\0')
    {
        ShowMessages("PDB file name: %s\n", ModuleInfo.LoadedPdbName);
    }
 
    //
    // Is debug information unmatched?
    // (It can only happen if the debug information is contained
    // in a separate file (.DBG or .PDB)
    //
    if (ModuleInfo.PdbUnmatched || ModuleInfo.DbgUnmatched)
    {
        ShowMessages("warning, unmatched symbols\n");
    }
 
    //
    // *** Contents ***
    //
 
    //
    // Line numbers available?
    //
    ShowMessages("line numbers: %s\n",
                 ModuleInfo.LineNumbers ? "available" : "not available");
 
    //
    // Global symbols available?
    //
    ShowMessages("global symbols: %s\n",
                 ModuleInfo.GlobalSymbols ? "available" : "not available");
 
    //
    // Type information available?
    //
    ShowMessages("type information: %s\n",
                 ModuleInfo.TypeInfo ? ("Available") : ("Not available"));
 
    //
    // Source indexing available?
    //
    ShowMessages("source indexing: %s\n",
                 ModuleInfo.SourceIndexed ? "yes" : "no");
 
    //
    // Public symbols available?
    //
    ShowMessages("public symbols: %s\n",
                 ModuleInfo.Publics ? "available" : "not available");
}

SymTagStr()

const char * SymTagStr

(

ULONG

Tag

)

Interpret different tags for pdbs.

Parameters

Tag

Returns

const char *

{
    switch (Tag)
    {
    case SymTagNull:
        return ("Null");
 
    case SymTagExe:
        return ("Exe");
 
    case SymTagCompiland:
        return ("Compiland");
 
    case SymTagCompilandDetails:
        return ("CompilandDetails");
 
    case SymTagCompilandEnv:
        return ("CompilandEnv");
 
    case SymTagFunction:
        return ("Function");
 
    case SymTagBlock:
        return ("Block");
 
    case SymTagData:
        return ("Data");
 
    case SymTagAnnotation:
        return ("Annotation");
 
    case SymTagLabel:
        return ("Label");
 
    case SymTagPublicSymbol:
        return ("PublicSymbol");
 
    case SymTagUDT:
        return ("UDT");
 
    case SymTagEnum:
        return ("Enum");
 
    case SymTagFunctionType:
        return ("FunctionType");
 
    case SymTagPointerType:
        return ("PointerType");
 
    case SymTagArrayType:
        return ("ArrayType");
 
    case SymTagBaseType:
        return ("BaseType");
 
    case SymTagTypedef:
        return ("Typedef");
 
    case SymTagBaseClass:
        return ("BaseClass");
 
    case SymTagFriend:
        return ("Friend");
 
    case SymTagFunctionArgType:
        return ("FunctionArgType");
 
    case SymTagFuncDebugStart:
        return ("FuncDebugStart");
 
    case SymTagFuncDebugEnd:
        return ("FuncDebugEnd");
 
    case SymTagUsingNamespace:
        return ("UsingNamespace");
 
    case SymTagVTableShape:
        return ("VTableShape");
 
    case SymTagVTable:
        return ("VTable");
 
    case SymTagCustom:
        return ("Custom");
 
    case SymTagThunk:
        return ("Thunk");
 
    case SymTagCustomType:
        return ("CustomType");
 
    case SymTagManagedType:
        return ("ManagedType");
 
    case SymTagDimension:
        return ("Dimension");
 
    default:
        return ("Unknown");
    }
 
    return ("");
}

Variable Documentation

AdditionalParameters

UINT64 BOOLEAN PVOID const char* AdditionalParameters

Address

UINT64 Address

argv

char** argv

buffer_address

char bool void* buffer_address

BufferAddress

UINT64 BOOLEAN PVOID BufferAddress

CustomModuleName

const char const char* CustomModuleName

DownloadIfAvailable

UINT32 BOOLEAN DownloadIfAvailable

FieldName

CHAR* FieldName

FieldOffset

CHAR UINT32* FieldOffset

FiledOfStructName

const char* FiledOfStructName

GuidAndAgeDetails

char char* GuidAndAgeDetails

Is32BitModule

char char BOOLEAN Is32BitModule

is_struct

char bool is_struct

IsFiledOfStructNamePointerOrNot

const char PBOOLEAN PBOOLEAN IsFiledOfStructNamePointerOrNot

IsSilentLoad

UINT32 BOOLEAN const char BOOLEAN IsSilentLoad

IsStruct

UINT64 BOOLEAN IsStruct

IsStructNamePointerOrNot

const char PBOOLEAN IsStructNamePointerOrNot

NewStructOrTypeName

const char PBOOLEAN PBOOLEAN char** NewStructOrTypeName

OffsetOfFieldFromTop

const char PBOOLEAN PBOOLEAN char UINT32* OffsetOfFieldFromTop

PdbFileName

const char* PdbFileName

PdbFilePath

char* PdbFilePath

ResultPath

char* ResultPath

SizeOfField

const char PBOOLEAN PBOOLEAN char UINT32 UINT32* SizeOfField

StoredLength

UINT32 StoredLength

SymbolPath

UINT32 BOOLEAN const char* SymbolPath

TypeSize

UINT64* TypeSize

WasFound

PBOOLEAN WasFound