Last active
March 2, 2025 06:30
-
-
Save eversinc33/86b4d1d71748a55efceb69a4f18f4d1d to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <windows.h> | |
#include <iostream> | |
#include <sstream> | |
std::string | |
GetSymbolServerURL( | |
const std::string& moduleName | |
) | |
{ | |
/* Extract timestamp and image size from a module | |
& convert to uppercase hex. Then construct the symbol url */ | |
HMODULE hModule = GetModuleHandleA(moduleName.c_str()); | |
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule; | |
PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((BYTE*)hModule + pDosHeader->e_lfanew); | |
DWORD timestamp = pNtHeaders->FileHeader.TimeDateStamp; | |
DWORD imageSize = pNtHeaders->OptionalHeader.SizeOfImage; | |
std::stringstream ss; | |
ss << std::hex << std::uppercase << timestamp << imageSize; | |
std::string symbolServerURL = "https://msdl.microsoft.com/download/symbols/" + moduleName + "/" + ss.str() + "/" + moduleName; | |
return symbolServerURL; | |
} | |
int | |
main() | |
{ | |
std::string module = "ntdll.dll"; | |
std::string url = GetSymbolServerURL(module); | |
std::cout << "[*] Symbol Server URL: " << url << std::endl; | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment