Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  IDA Debug: Loading Symbols for a DLL

Topic created on: February 8, 2007 14:49 CST by bmazic .

How do I load debugging symbols (or an IDB file) for a DLL used by the application being debugged?

I am trying to reverse engineer MSPATCHA.DLL. If I load the DLL directly into IDA Pro, the IDA finds and loads the associated PDB file and I can see all the internal symbols. Lovely.

So I wrote a little application that just calls a function in the DLL. Now, when I load the app into IDA, the IDA loads the application's PDB file, but not the MSPATCHA.DLL's PDB file (or what would be even better - the DLL's IDB file). In other words, when I start debugging the app and single step into the MSPATCHA.DLL not only that I don't see its local symbols, but the DLL has not being analysed by the IDA at all.

Any help would be greatly appreciated.

Boris

P.S. Is there anybody out there familiar with the patch file format (PA19)? I am particularly interested in the location of old file and new file CRC32s. They don't always seem to be at the same location in the patch file header.

  igorsk     February 8, 2007 18:46.45 CST
AFAIK loading of symbols for anything except the main binary is not supported. However, the pdb loader source is available, so you should be able to add the support.

  pedram     February 8, 2007 20:53.51 CST
You could try loading all your target files into the same IDB using Alti's PE scripts and then attaching to your target.

  gera     February 9, 2007 08:15.11 CST
When I have to do this (load symbols for multiple files in a single .idb) my option is to open the primary file in IDA, make all analysis, attach to a running process (so all DLLs are actually in memory), keep it open and then:

Open a secondary IDA, with a secondary binary, load all symbols for 2nd DLL, let the auto analysis finish, make all changes I want, and export as IDC (File -> Produce -> dump database to IDC).

Then I manually edit the produced IDC and leave only Enums() Structures() Bytes() and Functions().

In the primary IDA, atacched to the process, open the produced IDC file. This will load all informatio for the secondary DLL. Wait for analysis to finish

now, mark all segments pertaining to the secondary DLL as Loader Segment (Ctrl-S, select DLL segment, Enter/2xClick, Alt-S, remove Debuger Segment and add Loader segment).

This last change makes IDA save the information for additional segments into the .idb file.

You can load lots of extra .IDC of course.

There's one small detail: if the base for the DLL is different in the attached process than that of the static version loaded in the secondary IDA, I would say that it's best to first rebase the .idb in the secondary IDA, and then export all information.

All this process is quite simple, try it. No need for plugins or nothing

  gera     February 9, 2007 13:17.09 CST
> gera:
> now, mark all segments pertaining to the secondary DLL as Loader Segment (Ctrl-S, select DLL segment, Enter/2xClick, Alt-S, remove Debuger Segment and add Loader segment).

Just got an improvement from tOpO: instead of Ctrl-S to list the segments, better use Shift-F7, and from there, directly with Ctrl-E you can edit each segments attributes. Much quicker

  tOpO     February 9, 2007 22:06.46 CST
Here is a quick and dirty script that marks all the sections on the specified modules as LOADER so they can be dumped in an IDC file for further processing... Hope this helps you!

# --------< Begin Of Script / IDA-Python >-------------
# Chenge the separator char if needed
sep_char = ','

###############################################################
def start():
    label       = 'Please enter the module list separated by commas\n(with or without extension)'
    seg_truename= ''
    seg_name    = ''
    seg_class   = ''
    matches     = 0

    # Get the list of modules whose sections we are goind to mark as 'L' (Loader)
    modlist = askstr(HIST_SRCH, 'kernel32, sarasa.dll, tuvieja.dll', label)
    if modlist is None:
        print ' [-] User cancelled'
        return

    # convert to a list and extract .dll extension if needed
    modlist = modlist.split(sep_char)
    for mod in modlist:
        modlist[modlist.index(mod)] = mod.strip().split('.dll')[0]
        pass

    # check every section if met the criteria and mark as L
    for i in range(get_segm_qty()):
        seg          = getnseg(i)
        seg_name     = get_segm_name(seg.startEA)
        seg_truename = get_true_segm_name(seg)
        seg_class    = get_segm_class(seg)

        #print ' [-] Name: %s / True Name: %s / class %s' % (seg_name, seg_truename, seg_class)

        # mark the segment as loader if it is included in the list
        if seg_name.split('_dll')[0] in modlist:
            matches += 1
            seg.set_loader_segm(1)
    
    print ' [+] %d sections were found for the specified modules.' % matches

###############################################################

start()

Note: Registration is required to post to the forums.

There are 31,322 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit