search

tyranid / oleviewdotnet

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container
GNU General Public License v3.0
1.14k stars 185 forks source link

ParseIPIDEntries does not return any IPIDs anymore #22

Closed irsl closed 4 years ago

irsl commented 4 years ago

Just noticed that I can't open a process from the marshal view anymore. Under the hood it seems latest Microsoft has stripped the CIPIDTable::_palloc symbol out of their builds? Are you aware of this? Is there a workaround?

tyranid commented 4 years ago

Works fine for me. What version of Windows are you using and are you properly configuring symbols?

irsl commented 4 years ago

I'm on a standard Win10 home edition (Microsoft Windows [Version 10.0.18362.657]). It has been working seamlessly and I didn't touch the settings, it broke suddenly. Let me play a little bit with the settings, I'll get back to you once I feel a bit more comfortable with what's going on. Hopefully user error.

tyranid commented 4 years ago

Well I'm on Version 10.0.18363.693 and it's fine. The tool does have a symbol cache which regularly expires on updates if anything in combase changes. So in some cases not configuring anything will work, you update and it'll stop working again.

irsl commented 4 years ago

Something has changed with dbghelp.dll on my box. I don't have Windows Development kit installed and in the settings no path was selected for the file. After browsing it explicitly, the feature started working again. Thanks for the hint.

irsl commented 4 years ago

After looking into this I found that c:\windows\system32\dbghelp.dll was loaded by default (when the app was configured without an absolute path for this setting). It seems that version of the dll does not support symbol servers.

tyranid commented 4 years ago

Indeed, which is the best default I can have atm. If you've already got the symbols it will work but you'd need to point it at the symbol directory.