解析pdb文件獲得未導出變量地址（轉）

程序要用到dbghelp.dll中的一些函數
http://msdn.microsoft.com/en-us/library/ms679291%28VS.85%29.aspx
要本身下載系統對應的符號文件

首先是一些初始化的東西：
設置符號選項，調用下面兩個函數
   DWORD Options = SymGetOptions(); 
   Options = Options|SYMOPT_DEBUG;
   SymSetOptions(Options);

調用SymInitialize函數進行初始化（這是必須的）
   hProcess = GetCurrentProcess();
   BOOL bRet = SymInitialize(hProcess,0,FALSE);
   if(!bRet)
   {
    printf("SymInitialize error ...\n");
   }
能夠用函數SymSetSearchPath(hProcess,SymbolPath);設置符號搜索路徑

而後用SymLoadModule64加載模塊，這裏是ntoskrnl.exe
char FileName[256] ;
GetSystemDirectory(FileName,sizeof(FileName));
strcat(FileName,"\\ntoskrnl.exe");
BaseOfDll = SymLoadModule64(hProcess,NULL,FileName,NULL,0,0);

BaseOfDll返回加載的基址

而後就能夠調用SymEnumSymbols查詢符號了
SymEnumSymbols(hProcess,BaseOfDll,0,EnumSymCallBack,0);
參數EnumSymCallBack是一個回調函數，在裏面獲得未導出函數的VA，

BOOL CALLBACK EnumSymCallBack(PSYMBOL_INFO pSymInfo,ULONG SymbolSize,PVOID UserContext)
/*
   參數pSymInfo結構Name成員是符號名，Address是符號地址（The virtual address of the start of the symbol）
*/
{ 
   if(strcmp((pSymInfo->Name), "PspCreateProcessNotifyRoutine")==0)
   {
    printf("Oh,yeah! %s :%0x\n",pSymInfo->Name,pSymInfo->Address);
   }
   return TRUE;
}



完整代碼： 
[code]
#include <stdio.h>
#include <windows.h>
#include "dbghelp.h"

#pragma comment(lib,"dbghelp.lib")

BOOL CALLBACK EnumSymCallBack(PSYMBOL_INFO pSymInfo,ULONG SymbolSize,PVOID UserContext);

int main(int argc, char* argv[])
{
HANDLE hProcess;
DWORD64 BaseOfDll;
PIMAGEHLP_SYMBOL pSymbol = NULL;

DWORD Options = SymGetOptions();

Options = Options|SYMOPT_DEBUG;
SymSetOptions(Options);

hProcess = GetCurrentProcess();
BOOL bRet = SymInitialize(hProcess,0,FALSE);
if(!bRet)
{
   printf("SymInitialize error ...\n");
}
char SymbolPath[256];
GetCurrentDirectory(sizeof(SymbolPath),SymbolPath);
strcat(SymbolPath,"\\symbols");
SymSetSearchPath(hProcess,SymbolPath);

char FileName[256] ;
GetSystemDirectory(FileName,sizeof(FileName));
strcat(FileName,"\\ntoskrnl.exe");
BaseOfDll = SymLoadModule64(hProcess,NULL,FileName,NULL,0,0);
if(BaseOfDll == 0)
{
   DWORD nErr = GetLastError();
}
SymEnumSymbols(hProcess,BaseOfDll,0,EnumSymCallBack,0);
SymUnloadModule64(hProcess,BaseOfDll);
SymCleanup(hProcess);
for(;;);

return 0;
}

BOOL CALLBACK EnumSymCallBack(PSYMBOL_INFO pSymInfo,ULONG SymbolSize,PVOID UserContext)
{ 
if(strcmp((pSymInfo->Name), "PspCreateProcessNotifyRoutine")==0)
{
   printf("Oh,yeah! %s :%0x\n",pSymInfo->Name,pSymInfo->Address);
}
if(strcmp((pSymInfo->Name), "PspLoadImageNotifyRoutine")==0)
{
   printf("Oh,yeah! %s :%0x\n",pSymInfo->Name,pSymInfo->Address);
}
if(strcmp((pSymInfo->Name), "PspCreateThreadNotifyRoutine")==0)
{
   printf("Oh,yeah! %s :%0x\n",pSymInfo->Name,pSymInfo->Address);
}
if(strcmp((pSymInfo->Name), "CmpCallBackVector")==0)
{
   printf("Oh,yeah! %s :%0x\n",pSymInfo->Name,pSymInfo->Address);
}
if(strcmp((pSymInfo->Name), "KeBugCheckCallBackListHead")==0)
{
   printf("Oh,yeah! %s :%0x\n",pSymInfo->Name,pSymInfo->Address);
}

return TRUE;
}

jpg改rar