Skip to content

Fix SymLoadModuleEx failing to find PDB files #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
irp24 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix SymLoadModuleEx failing to find PDB files #33

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion Alcatraz/pdbparser/pdbparser.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ pdbparser::pdbparser(pe64* pe) {

}

SymSetSearchPath(GetCurrentProcess(), std::filesystem::path(pdb_path).parent_path().string().c_str());
Copy link

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SymSetSearchPath replaces the entire symbol search path for the process. Setting it to only the PDB’s parent directory can unintentionally drop existing paths (e.g., _NT_SYMBOL_PATH / symbol server settings) and break symbol resolution elsewhere. Consider reading the existing path (e.g., via SymGetSearchPath) and prepending/appending the target directory instead of overwriting it.

Suggested change
SymSetSearchPath(GetCurrentProcess(), std::filesystem::path(pdb_path).parent_path().string().c_str());
std::string pdb_dir = std::filesystem::path(pdb_path).parent_path().string();
char existing_search_path[2048] = { 0 };
if (SymGetSearchPath(GetCurrentProcess(), existing_search_path, static_cast<DWORD>(sizeof(existing_search_path)))) {
if (existing_search_path[0] != '\0') {
std::string combined_search_path = pdb_dir + ";" + existing_search_path;
SymSetSearchPath(GetCurrentProcess(), combined_search_path.c_str());
}
else {
SymSetSearchPath(GetCurrentProcess(), pdb_dir.c_str());
}
}
else {
SymSetSearchPath(GetCurrentProcess(), pdb_dir.c_str());
}

Copilot uses AI. Check for mistakes.
this->module_base =
Comment on lines +54 to 55
Copy link

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SymSetSearchPath's return value is ignored here. If it fails (e.g., invalid/empty parent path), the subsequent SymLoadModuleEx error will be misleading and harder to diagnose. Please check the BOOL result, and on failure surface GetLastError() (and consider skipping/avoiding setting an empty search path when parent_path() is empty).

Suggested change
SymSetSearchPath(GetCurrentProcess(), std::filesystem::path(pdb_path).parent_path().string().c_str());
this->module_base =
std::filesystem::path parent_path = std::filesystem::path(pdb_path).parent_path();
if (!parent_path.empty()) {
std::string parent_path_str = parent_path.string();
if (!SymSetSearchPath(GetCurrentProcess(), parent_path_str.c_str())) {
DWORD err = GetLastError();
throw std::runtime_error("SymSetSearchPath failed with error " + std::to_string(err));
}
}
this->module_base =

Copilot uses AI. Check for mistakes.
reinterpret_cast<uint8_t*>(SymLoadModuleEx(GetCurrentProcess(), 0, pdb_path.c_str(), 0, 0x10000000, static_cast<std::uint32_t>(std::filesystem::file_size(pdb_path)), 0, 0));

Expand Down Expand Up @@ -115,4 +116,4 @@ std::vector<pdbparser::sym_func>pdbparser::parse_functions() {
throw std::runtime_error("couldn't enum symbols");

return functions;
}
}
Loading