Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
37 lines (32 sloc) 884 Bytes
$$
$$ Author: Javier Vicente Vallejo
$$ Twitter: @vallejocc
$$ Web: http://www.vallejo.cc
$$
$$
$$ $$>a<dump_process_symbols_to_file.wdbg <path> <proc>
$$
$$ This simple script will dump to a file all the symbols of the given process.
$$ If you dump a PE from memory, it could have variables pointing to symbols (for example, api addresses that it got with GetProcAddress, etc...).
$$ It is useful to have a list of pairs (symbol, address) because in this way if we open the dumped PE with IDA we can search for that addresses
$$ and set a name for the variable containing them.
$$
.block
{
.sympath "SRV*c:\symcache*http://msdl.microsoft.com/download/symbols";
.reload
}
.block
{
.process /i ${$arg2}
g
.block
{
.reload
}
.block
{
.reload /user
}
.block { .shell -i- -ci "x *!*" findstr "!">${$arg1} }
}