How to use a symbolic file?

Almost every command uses symbolic information directly or indirectly. There are not many command checks.

 

The command for viewing symbols is X, which indicates "viewing symbols". The syntax is as follows:

0.00> X [Options] module! Symbols

 

Both module and symbols can contain wildcards.CodeWildcard is a powerful tool, because it allows us to guess the function name or global variable before reading the code.

The function with the _ imp prefix indicates that this module is the module that introduces the function. The function without _ imp is the module that implements this function.

 

When the debugger uses a public symbol file, these symbol check commands cannot provide all functions.

 

Another command that can fully utilize the symbols is ln, and LN indicates list near. this command will give the symbolic information related to a specific address as much as possible. if no symbols match the address exactly, the debugger uses the pointerAlgorithmCalculate the symbol near this address, and return the symbol of the calculation result and the offset between the input address and the symbol.

 

This command can be of great help when you are viewing some data but do not know the content indicated by this data. if the address being analyzed is part of the stack, you may find the code sequence from the call stack. ln helps you identify them. if you are viewing a heap block, you may find some fragments of the original object, which will help you find the purpose of this heap block.

 

From <advanced Windows debugging>