1

I am able to get line information at a giving address using dbghelp.dll by calling SymGetLineFromAddr64() of dbghelp.dll.

It only gives me source code information of that address (e.g. line number and file name). However, in WinDBG, I can also get assembly code of given address. I am not sure how I can do it using dbghelp.dll. If not possible, any other dll I can use?

stanleyli
  • 1,427
  • 1
  • 11
  • 28
  • 2
    That is the job of [the debugger](https://msdn.microsoft.com/en-us/library/windows/hardware/ff552179(v=vs.85).aspx), not of dbghelp.dll. Or use ReadProcessMemory(). – Hans Passant Oct 10 '16 at 17:17

1 Answers1

1

I don't think you can get a disassembly listing from dbghelp. It is however pretty easy, although more work than you probably want, to integrate the free OllyDbg Disassembler 2.01 engine into your code as long as the correct starting address for the instructions is specified when disassembling a line; i.e.: you don't start with an address that is mid-instruction which I think dbghelp takes care of. That is, assuming you want to disassemble x86 code.

The only trick might be to obtain how many bytes in length the current line is so you know how much to disassemble, if you wanted to be fancier than a hardcoded amount of say 64 bytes from the start of the current line. If you enumerated all of the source lines for the module via SymEnumLines() beforehand, you could use that information to find not only the current line but how many bytes until the following line.

byteptr
  • 1,275
  • 11
  • 15