PRB: IMAGEHLP Symbol Handler Functions Cannot Locate Nonpublic Symbols

• Microsoft Win32 Application Programming Interface (API), used with:
  • Microsoft Windows versions 95, 98, 98 Second Edition
  • Microsoft Windows NT 4.0
  • Microsoft Windows 2000

SYMPTOMS

Locating symbolic information in any executable module using SymGetSymFromName() or SymGetSymFromAddr() may not give the desired results for nonpublic symbols. This article explains the limitation of not locating a nonpublic symbol in any executable module by its name or by its corresponding virtual address.

CAUSE

The functionality to locate nonpublic symbols is not implemented in IMAGEHLP.

MORE INFORMATION

The symbol handler functions of the ImageHlp API can correctly locate only public symbol information in a module.

Once the symbol information of a module has been loaded, the virtual address corresponding to a public function or a variable in that module can be obtained using SymGetSymFromName(). However, the virtual address corresponding to a private function or a variable defined in that module cannot be obtained. If an application specifies a symbolic name that is not public, SymGetSymFromName() fails with an error code of 126 (ERROR_MOD_NOT_FOUND).

If an application knows the virtual address of a public function or a variable defined in a module, SymGetSymFromAddr() can be used to find its corresponding symbol name. If the application specifies a virtual address corresponding to a private function or a variable, SymGetSymFromAddr() locates the nearest public symbol information. Although the SymGetSymFromAddr() API succeeds, the function name returned does not point to the corresponding private function or a variable.

Additional query words:

Keywords : kbAPI kbDebug kbImgHlp kbKernBase kbNTOS400 kbWinOS2000 kbSDKPlatform kbSDKWin32 kbWinOS95 kbWinOS98 kbDSupport kbGrpKernBase
Version : winnt:4.0
Platform : winnt
Issue type : kbprb