diff --git a/docs/source/samples_output/debug_symbol_debugger.txt b/docs/source/samples_output/debug_symbol_debugger.txt new file mode 100644 index 0000000..e780223 --- /dev/null +++ b/docs/source/samples_output/debug_symbol_debugger.txt @@ -0,0 +1,15 @@ +(cmd) python debug\symbol_debugger.py +Namespace(dbghelp=None) +Breakpoint triggered at: ntdll!LdrpInitializeProcess + + +Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2 + + +Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2 + + +Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2 + +Quitting + diff --git a/docs/source/samples_output/debug_symbol_processsymdemo.txt b/docs/source/samples_output/debug_symbol_processsymdemo.txt new file mode 100644 index 0000000..3eb4a6d --- /dev/null +++ b/docs/source/samples_output/debug_symbol_processsymdemo.txt @@ -0,0 +1,16 @@ +(cmd) python debug\symbols\processsymdemo.py +Namespace(dbghelp=None) +Target is +Some loaded modules are: + * + * + * + +Resolving function +Symbol found ! + * __repr__: + * __str__: advapi32!CreateServiceEx + * addr: 0x764647b0 + * name: CreateServiceEx + * fullname: advapi32!CreateServiceEx + * module: diff --git a/docs/source/samples_output/debug_symbol_symsearch.txt b/docs/source/samples_output/debug_symbol_symsearch.txt new file mode 100644 index 0000000..7e48378 --- /dev/null +++ b/docs/source/samples_output/debug_symbol_symsearch.txt @@ -0,0 +1,34 @@ +$ python64 debug\symbols\symsearch.py "CreateFile*" c:\windows\system32\kernelbase.dll +Namespace(addr=0, dbghelp=None, file='c:\\windows\\system32\\kernelbase.dll', pattern='CreateFile*', tag=0) +16 symbols found: + * + * + * + * + * + * + * + * + * + * + * + * + * + * + * + * + + +$ python64 debug\symbols\symsearch.py "NtCreate*" c:\windows\system32\ntdll.dll --addr 0x42000000 +Namespace(addr=1107296256, dbghelp=None, file='c:\\windows\\system32\\ntdll.dll', pattern='NtCreate*', tag=0) +47 symbols found: + * + * + * + * + * + * + * + * + * + ... diff --git a/docs/source/samples_output/debug_symbol_virtsymdemo.txt b/docs/source/samples_output/debug_symbol_virtsymdemo.txt new file mode 100644 index 0000000..2336f0d --- /dev/null +++ b/docs/source/samples_output/debug_symbol_virtsymdemo.txt @@ -0,0 +1,30 @@ +(cmd) python debug\symbols\virtsymdemo.py +Namespace(dbghelp=None) +Ntdll module is: + * name = ntdll + * addr = 0x420000 + * path = c:\windows\system32\ntdll.dll + * type = + * pdb = d:\symbols\wntdll.pdb\3D038F31BBBF51C701937460DBAB1F531\wntdll.pdb + +Resolving function +Symbol found ! + * __repr__: + * __str__: ntdll!LdrLoadDll + * addr: 0x464d30 + * name: LdrLoadDll + * fullname: ntdll!LdrLoadDll + * module: + +Loading kernelbase +Loaded modules are: [, ] +Looking up address: 0x1231242 +Symbol resolved ! + * __repr__: + * __str__: kernelbase!__load_config_used+0x12 + * start: 0x1231230 + * addr: 0x1231242 + * displacement: 0x12 + * name: __load_config_used + * fullname: kernelbase!__load_config_used+0x12 + * module: