search

microsoft / WinDbg-Samples

Sample extensions, scripts, and API uses for WinDbg.
MIT License
719 stars 120 forks source link

ImageInfo.js doesn't display module's image info #2

Closed xiaoyinl closed 5 years ago

xiaoyinl commented 5 years ago

I followed the Usage guide, but it doesn't seem to show the PE image info when I run dx @$curprocess.Modules[0].

0:000> .scriptload C:\Users\[myusername]\Documents\GitHub\WinDbg-Samples\ImageInfo\ImageInfo.js
JavaScript script successfully loaded from 'C:\Users\[myusername]\Documents\GitHub\WinDbg-Samples\ImageInfo\ImageInfo.js'
0:000> dx @$curprocess.Modules[0]
@$curprocess.Modules[0] : cmd.exe
    BaseAddress      : 0x7ff684150000
    Name             : cmd.exe
    Size             : 0x65000
    Contents

Debugger client version: 1.0.1810.02001 Debugger engine version: 10.0.18239.1000 OS: Windows 10 x64 17763.134

Did I misunderstand how this script work? How do I use it to display PE image info, like import table?

Thank you!

wmessmer-msft commented 5 years ago

Did you click the DML link provided by "Contents" (or otherwise go into that object)?

0:007> dx @$curprocess.Modules[0]
@$curprocess.Modules[0]                 : notepad.exe
    BaseAddress      : 0x7ff6d88f0000
    Name             : notepad.exe
    Size             : 0x43000
    Contents

0:007> dx -r1 @$curprocess.Modules[0].Contents
@$curprocess.Modules[0].Contents                
    Headers         
    Directories     
    Resources       
    Imports         
    DelayImports    
    Exports         
    DebugInfo       
    Version          : VS_VERSION_INFO

0:007> dx -r1 @$curprocess.Modules[0].Contents.Imports
@$curprocess.Modules[0].Contents.Imports                
    ["ADVAPI32.dll"] : ADVAPI32.dll
    ["KERNEL32.dll"] : KERNEL32.dll
    ["GDI32.dll"]    : GDI32.dll
    ...
xiaoyinl commented 5 years ago

Indeed I didn't go into the Contents object. Now I know that. Thank you, @wmessmer-msft!