viewing DLL symbols

Hi, guys
Is it possible to view the symbols for a DLL mapped into the memory of a user-mode process?

  1. The user mode process calls LoadLibrary(“mydll”) with a valid return value
  2. using “.process /i” command I change the context to the relevant process
  3. !peb approves the DLL is mapped into the process’s address space

Now, “x mymodule!mydll*” just does not seem to work…
and also “lm vm mymodule!mydll” showed empty lines…

depends.exe utility shows that the export is inside the DLL…

What might be the problem here?
googling and ogling the debugger did not help…

Thanks!

Try issuing ‘.reload -f’ before enumerating the symbols.

Good luck,

mm
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, March 31, 2011 8:48 AM
To: Kernel Debugging Interest List
Subject: [windbg] viewing DLL symbols

Hi, guys
Is it possible to view the symbols for a DLL mapped into the memory of a
user-mode process?

  1. The user mode process calls LoadLibrary(“mydll”) with a valid return
    value
  2. using “.process /i” command I change the context to the relevant process
  3. !peb approves the DLL is mapped into the process’s address space

Now, “x mymodule!mydll*” just does not seem to work…
and also “lm vm mymodule!mydll” showed empty lines…

depends.exe utility shows that the export is inside the DLL…

What might be the problem here?
googling and ogling the debugger did not help…

Thanks!


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

And of course you have the symbol server setup properly in WinDbg? If it’s your DLL use SymStore to add and update the DLLs symbols in your local symbol store. Have you tried Visual Studio, with the symbol server set there?

Gary G. Little

----- Original Message -----
From: xxxxx@gmail.com
To: “Kernel Debugging Interest List”
Sent: Thursday, March 31, 2011 7:48:27 AM
Subject: [windbg] viewing DLL symbols

Hi, guys
Is it possible to view the symbols for a DLL mapped into the memory of a user-mode process?

1. The user mode process calls LoadLibrary(“mydll”) with a valid return value
2. using “.process /i” command I change the context to the relevant process
3. !peb approves the DLL is mapped into the process’s address space

Now, “x mymodule!mydll*” just does not seem to work…
and also “lm vm mymodule!mydll” showed empty lines…

depends.exe utility shows that the export is inside the DLL…

What might be the problem here?
googling and ogling the debugger did not help…

Thanks!


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

If that doesn’t work, issue ‘!sym noisy’ and try the reload again. It will help you find symbol resolution problems.

-Gary

On Mar 31, 2011, at 9:53 AM, Martin O’Brien wrote:

Try issuing ‘.reload -f’ before enumerating the symbols.

Good luck,

mm
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, March 31, 2011 8:48 AM
To: Kernel Debugging Interest List
Subject: [windbg] viewing DLL symbols

Hi, guys
Is it possible to view the symbols for a DLL mapped into the memory of a
user-mode process?

  1. The user mode process calls LoadLibrary(“mydll”) with a valid return
    value
  2. using “.process /i” command I change the context to the relevant process
  3. !peb approves the DLL is mapped into the process’s address space

Now, “x mymodule!mydll*” just does not seem to work…
and also “lm vm mymodule!mydll” showed empty lines…

depends.exe utility shows that the export is inside the DLL…

What might be the problem here?
googling and ogling the debugger did not help…

Thanks!


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Read this article for details on why you’re not seeing your DLL on the user
loaded module list:

http://osronline.com/article.cfm?article=576

-scott


Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@windbg…

Hi, guys
Is it possible to view the symbols for a DLL mapped into the memory of a
user-mode process?

  1. The user mode process calls LoadLibrary(“mydll”) with a valid return
    value
  2. using “.process /i” command I change the context to the relevant process
  3. !peb approves the DLL is mapped into the process’s address space

Now, “x mymodule!mydll*” just does not seem to work…
and also “lm vm mymodule!mydll” showed empty lines…

depends.exe utility shows that the export is inside the DLL…

What might be the problem here?
googling and ogling the debugger did not help…

Thanks!

Have you tried doing
x mydll!*

Best wishes
Rafał


Sent from mobile phone

On 31 Mar 2011, at 13:57, “Gary G. Little” wrote:

And of course you have the symbol server setup properly in WinDbg? If it’s
your DLL use SymStore to add and update the DLLs symbols in your local
symbol store. Have you tried Visual Studio, with the symbol server set
there?

Gary G. Little

----- Original Message -----
From: xxxxx@gmail.com
To: “Kernel Debugging Interest List”
Sent: Thursday, March 31, 2011 7:48:27 AM
Subject: [windbg] viewing DLL symbols

Hi, guys
Is it possible to view the symbols for a DLL mapped into the memory of a
user-mode process?

1. The user mode process calls LoadLibrary(“mydll”) with a valid return
value
2. using “.process /i” command I change the context to the relevant process
3. !peb approves the DLL is mapped into the process’s address space

Now, “x mymodule!mydll*” just does not seem to work…
and also “lm vm mymodule!mydll” showed empty lines…

depends.exe utility shows that the export is inside the DLL…

What might be the problem here?
googling and ogling the debugger did not help…

Thanks!


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer