February 2012
Intermediate to advanced
800 pages
23h 55m
English
Content preview from Practical Malware AnalysisBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Microsoft Symbols
Debugging symbols provide limited information from the source code to help understand assembly code. The symbols provided by Microsoft contain names for certain functions and variables.
A symbol in this context is simply a name for a particular memory
address. Most symbols provide a name for addresses that represent functions, but some provide a name
for addresses that represent data addresses. For example, without symbol information, the function
at address 8050f1a2 will not be labeled. If you have symbol information configured, WinDbg will tell
you that the function is named MmCreateProcessAddressSpace (assuming that was the name of the function at that address). With just an address, you wouldn’t know much about a function, ...