Getting the symbols for a debugged application

Merrion

I am trying to thet the debug symbols for an application in order to debug it and am using the dbghelp.dll.

I have the following declarations:-

'DWORD64 SymLoadModule64(
'  HANDLE hProcess,
'  HANDLE hFile,
'  PSTR ImageName,
'  PSTR ModuleName,
'  DWORD64 BaseOfDll,
'  DWORD SizeOfDll);
Public Declare Function SymLoadModule Lib "dbghelp.dll" ( _
       ByVal bProcess As Long, _
       ByVal hfile As Long, _
       ByVal ImageName As String, _
       ByVal ModuleName As String, _
       ByVal BaseOfDll As Long, _
       ByVal SizeOfDll As Long) As Long
       
'BOOL SymUnloadModule64(
'  HANDLE hProcess,
'  DWORD64 BaseOfDll);
Public Declare Function SymUnloadModule Lib "dbghelp.dll" ( _
        ByVal hProcess As Long, _
        ByVal BaseOfDll As Long) As Long

'BOOL SymInitialize(
'  HANDLE hProcess,
'  PSTR UserSearchPath,
'  BOOL fInvadeProcess
');
Public Declare Function SymInitialize Lib "dbghelp.dll" ( _
     ByVal hProcess As Long, _
     ByVal UserSearchPath As String, _
     ByVal fInvadeProcess As Boolean) As Long
     
'BOOL SymCleanup(
'  Handle hProcess
');
Public Declare Function SymCleanup Lib "dbghelp.dll" (ByVal hProcess As Long) As Long

And I am attaching to the external process using the debug api calls:-

'\\ Debug API calls
Private Declare Function DebugActiveProcess Lib "kernel32" (ByVal dwProcessId As Long) As Long
Private Declare Function WaitForDebugEvent Lib "kernel32" (lpDebugEvent As DEBUG_EVENT_BUFFER, ByVal dwMilliseconds As Long) As Long
Private Declare Function ContinueDebugEvent Lib "kernel32" (ByVal dwProcessId As Long, ByVal dwThreadId As Long, ByVal dwContinueStatus As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

...when I get a debug event: CREATE_PROCESS_DEBUG_EVENT I an trying to load the symbols for the process thus:-

If SymInitialize(DebugProcess.Handle, "",False) Then
  '\\ Initailise the symbol stuff
  If SymLoadModule(DebugProcess.Handle, 0, "", Name, 0, 0) Then
      bSymbolsLoaded = True
  End If
  SymUninitisalize(DebugProcess.Handle)
End If

But the call to SymLoadModule returns zero..however Err.LastDllError is not set? Any ideas as to what is going on here?


__________________

Merrion

As soon as I post this the answer hits me straight in the face:

If SymLoadModule(DebugProcess.Handle, 0, Name, Name, 0, 0) Then
'...

You have to pass ImageName and Modulename...

Merrion

Slow progress...

I now have the SymLoadModule call working so am calling SymEnumerateSymbols to list the symbols in the module....

Declaration:-

Private Type IMAGEHELP_SYMBOL
  SizeOfStruct As Long
  Address As Long
  size As Long
  Flags As Long
  MaxNameLength As Long
  Name As String
End Type

Private Declare Function SymEnumerateSymbols Lib "dbghelp.dll" ( _
                 ByVal hProcess As Long, _
                 ByVal BaseOfDll As Long, _
                 ByVal lpCallback As Long, _
                 ByVal UserContext As Long) As Long

'BOOL SymGetSymFromAddr(
'  HANDLE hProcess,
'  DWORD Address,
'  DWORD Displacement,
'  PIMAGEHLP_SYMBOL64 Symbol
Private Declare Function SymGetSymFromAddr Lib "dbghelp.dll" ( _
            ByVal hProcess As Long, _
            ByVal Address As Long, _
            ByVal Displacement As Long, _
            Symbol As IMAGEHELP_SYMBOL) As Long

With the callback defined thus:-

'BOOL CALLBACK sym_handler(char const *name,
'                        unsigned long addr,
'                        unsigned long size,
'                        void *file) {
'    fprintf((FILE *)file, "\t\t%s\n", name);
'    return TRUE
Public Function SymHandler(ByVal lpName As Long, ByVal Address As Long, ByVal size As Long, ByVal lpFile As Long) As Long

Dim sThis As IMAGEHELP_SYMBOL

With sThis
    .Name = String$(1024, 0)
    .MaxNameLength = 1024
    .SizeOfStruct = Len(sThis)
    .size = size
End With

If SymGetSymFromAddr(DebugProcess.Handle, Address, 0, sThis) Then
    Debug.Print sThis.Name
End If
SymHandler = -1

End Function

But when SymGetSymFromAddr is called it jumps out of the callback and err.lastDllError is set to &HC0000005 (EXCEPTION_ACCESS_VIOLATION)

Any ideas?