Wrong symbol address for some pdb file

Open Tai7sy opened this issue 8 months ago • 1 comments

https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/3844DBB920174967BE7AA4A2C20430FA2/ntkrnlmp.pdb

symbol name: IopCheckListForCancelableIrp (any symbol name)

wrong in web version or console version

the right value in IDA/windbg

Apr 13 '25 09:04 Tai7sy

After a long time revsesing on dbghelp.dll, I found how dbghelp.SymFromName works https://github.com/Tai7sy/resym/commit/b28acfccf502c7f9a3d63e25c2576a1b9ab0b55d

Apr 13 '25 17:04 Tai7sy