Method load

windows/debug/symbols.py:645–666

Load the :class:`SymbolModule` associated with the loaded module ``name`` (as found in the PEB) :return: :class:`SymbolModule` Exemple: >>> sh = windows.debug.symbols.ProcessSymbolHandler(windows.test.pop_proc_64()) <windows.debug.symbols.ProcessSymbolHandl

(self, name)

    # module that is already loaded
    # Question: should be able to load other module at other address ?
    def load(self, name):
        """Load the :class:`SymbolModule` associated with the loaded module ``name`` (as found in the PEB)

        :return: :class:`SymbolModule`

        Exemple:

            >>> sh = windows.debug.symbols.ProcessSymbolHandler(windows.test.pop_proc_64())
            <windows.debug.symbols.ProcessSymbolHandler object at 0x033A2C30>
            >>> sh
            <windows.debug.symbols.ProcessSymbolHandler object at 0x033A2C30>
            >>> sh.load("kernelbase.dll")
            <SymbolModule name="kernelbase" type=SymDeferred pdb="" addr=0x7ffb5b090000>
            >>> sh["kernelbase!CreateProcessA"]
            <SymbolInfoA name="CreateProcessA" start=0x7ffb5b2371f0 tag=SymTagPublicSymbol>
        """
        mods = [x for x in self.target.peb.modules if x.name == name]
        if not mods:
            raise ValueError("Could not find module <{0}>".format(name))
        assert len(mods) == 1 # Load all if multiple match ?
        mod = mods[0]
        return self.load_module(addr=mod.baseaddr, path=mod.fullname)

    def refresh(self):
        """Update the list of loaded modules to match the modules present in the target process