Microsoft Symbols
Debugging symbols provide limited information from the source code to help understand assembly code. The symbols provided by Microsoft contain names for certain functions and variables.
A symbol in this context is simply a name for a particular memory
address. Most symbols provide a name for addresses that represent functions, but some provide a name
for addresses that represent data addresses. For example, without symbol information, the function
at address 8050f1a2 will not be labeled. If you have symbol information configured, WinDbg will tell
you that the function is named MmCreateProcessAddressSpace (assuming that was the name of the function at that address). With just an address, you wouldn’t know much about a function, ...
Get Practical Malware Analysis now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
