我正在使用PYKD技术进行转储,并尝试对其进行调查.
x / 2 *!*“vtable”(仅一个反引号)的结果包含以下结果:
745293b8 mfc110u!CPtrList::`vftable'
但是,当我尝试获取有关此类的更多信息时,出现“找不到符号”异常:
Python源代码:
dprintln("name=[%s]" % type_stats.name)
if not type_stats.name in typesize_by_type:
try:
type_info = typeInfo(type_stats.name)
except Exception, e:
dprintln("text=[%s]" % (str(e)))
输出:
name=[mfc110u!CPtrList]
text=['CPtrList' - symbol not found]
lm命令的结果返回mfc110u符号,如下所示:
0:000> lm
start end module name
...
744f0000 74930000 mfc110u (pdb symbols) C:\ProgramData\dbg\sym\mfc110u.i386.pdb\...\mfc110u.i386.pdb
...
供您参考,我正在使用最新版本的PYKD:
0:000> .chain
Extension DLL search Path:
...
Extension DLL chain:
pykd.pyd: image 0.3.3.4, API 1.0.0, built Mon May 14 11:14:43 2018
[path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext\pykd.pyd]
同时,我发现了一种非常简单的方法来再现问题,而无需启动整个脚本(使用Windbg提示符):
0:000> !py
Python 2.7.10 (default, May 23 2015, 09:40:32) [MSC v.1500 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> typeInfo("mfc110u!CPtrList")
Traceback (most recent call last):
File "<console>", line 1, in <module>
SymbolException: 'CPtrList' - symbol not found
除了ussrhero的答案,还有以下额外信息:
x / 2 *!CPtrList *的结果包含(以及许多其他结果)以下结果:
009530c4 <application>!CPtrList::~CPtrList
009530be <application>!CPtrList::CPtrList
... <application>!CPtrList::...
009abc5c <application>!CPtrList::`RTTI Base Class Array'
009abc4c <application>!CPtrList::`RTTI Class Hierarchy Descriptor'
009bcd18 <application>!CPtrList `RTTI Type Descriptor'
009abc30 <application>!CPtrList::`RTTI Base Class Descriptor at (0,-1,0,64)'
7464e9cb mfc110u!CPtrList::~CPtrList
74544a04 mfc110u!CPtrList::CPtrList
... mfc110u!CPtrList::...
745293b8 mfc110u!CPtrList::`vftable'
747510da mfc110u!CPtrList::`vector deleting destructor'
745293cc mfc110u!CPtrList::`RTTI Complete Object Locator'
7452940c mfc110u!CPtrList::`RTTI Base Class Array'
745293fc mfc110u!CPtrList::`RTTI Class Hierarchy Descriptor'
74795778 mfc110u!CPtrList `RTTI Type Descriptor'
745293e0 mfc110u!CPtrList::`RTTI Base Class Descriptor at (0,-1,0,64)'
746fdc68 mfc110u!CPtrList::classCPtrList
我正在使用的脚本(heap_stat.py)浏览!heap -h 0的结果并搜索与mfc110u!CPtrList ::“vtable’相对应的条目.
dt CPtrList的结果从以下开始:
0:000> dt CPtrList
<application>!CPtrList => in other words, no 'mfcu110' entry
+0x000 __VFN_table : Ptr32
我已经想了很长时间了,mfc110u!CPtrList和< application>!CPtrList条目之间有什么区别,vtable条目在x / 2结果中的确切作用是什么?
有任何想法吗?
谢谢
解决方法:
同时,我找到了解决方案:
显然,对于某些对象,需要删除模块前缀:
>>> typeInfo("mdf110u!CPtrList")
-> SymbolException
>>> typeInfo("CPtrList")
-> this is working!!!