Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fetch symbols in Rust rather than with symchk.exe #3

Open
1 of 3 tasks
DrChat opened this issue Aug 27, 2020 · 0 comments
Open
1 of 3 tasks

Fetch symbols in Rust rather than with symchk.exe #3

DrChat opened this issue Aug 27, 2020 · 0 comments

Comments

@DrChat
Copy link

DrChat commented Aug 27, 2020

The process of fetching symbols seems to be pretty simple. To do so, you need the PDB filename and hash, and then you can issue a request to Microsoft's symbol server.

E.g: for ntoskrnl.exe

http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/F3A4F64B6F639A058AD6F33155ACA4F61/ntkrnlmp.pdb

Or, for the compressed copy:

http://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/F3A4F64B6F639A058AD6F33155ACA4F61/ntkrnlmp.pd_

The symbol string commonly stored in _NT_SYMBOL_PATH takes the following form:

SRV*<path>*<URL>

E.g:

SRV*C:\symcache*http://msdl.microsoft.com/download/symbols

More advanced forms here.

Implementation

In lieu of supporting the full _NT_SYMBOL_PATH syntax, we'll just support the server and folder portions.

  • Basic symbol fetching
  • Fetching compressed symbols
  • Fetching symbols from alternate server layout

References

https://randomascii.wordpress.com/2013/03/09/symbols-the-microsoft-way/
https://randomascii.wordpress.com/2020/03/14/creating-a-public-symbol-server-easily/
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/symbol-store-folder-tree
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/advanced-symsrv-use

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant