Read symbols from the debugger backend #210

Activity

1. xusheng6

   added

   enhancementNew feature or requestNew feature or request

   Effort: High

   Impact: Medium

   on Nov 2, 2022
2. xusheng6

   added this to the Braize milestone on Feb 28, 2023
3. plafosse

   assigned

   xusheng6

   on Feb 28, 2023
4. xusheng6

   modified the milestones: Braize, Coruscant on Apr 11, 2023
5. plafosse

   modified the milestones: Coruscant, Dorsai on Aug 1, 2023
6. xusheng6 commented on Nov 17, 2023

   

   xusheng6

   on Nov 17, 2023

   MemberAuthor

   More actions

   So a compromise on this is that we can offer a method to read the symbol at a specific address. The users can use this API on demand. This avoids many tricky design issues, e.g., how often/when should we update the symbols.
7. plafosse

   modified the milestones: Dorsai, Elysium on Jan 10, 2024
8. xusheng6

   modified the milestones: Elysium, Fhloston on Mar 26, 2024
9. xusheng6

   modified the milestones: Frogstar, FutureThis milestone has been deleted on Jul 23, 2024
10. plafosse

    removed this from the Future milestone on May 2, 2025
11. plafosse

    removed

    enhancementNew feature or requestNew feature or request

    on Jun 12, 2025
12. plafosse

    added the

    Enhancement

    issue type on Jun 12, 2025
13. xusheng6 commented on Sep 26, 2025

    

    xusheng6

    on Sep 26, 2025

    MemberAuthor

    More actions

    Dumping this. A common scenario is where the user debugs some code and a register now points to an API function. Right now he would not be able to see it. We should somehow offer a way to do it
14. xusheng6 commented on Mar 20, 2026

    

    xusheng6

    on Mar 20, 2026

    MemberAuthor

    More actions

    Design Notes (from code review of x64dbg + internal discussion)

    How x64dbg handles symbols

    • Per-module lifecycle: Symbols are loaded on LOAD_DLL_DEBUG_EVENT and unloaded on UNLOAD_DLL_DEBUG_EVENT. They are never refreshed on step/breakpoint — only on module load/unload.
    • Async loading: Background threads per module so symbol loading doesn't block the debugger.
    • Full refresh per module, not incremental: Old symbols destroyed and rebuilt from scratch when a module reloads.
    • Data structures: Sorted vectors for O(log n) binary search by address and by name.

    Proposed design for our debugger

    Key insight: Symbols are tied to module lifecycle, not execution state. They should NOT be in the dirty-flag refresh cycle that runs on every stop event. Instead, piggyback on the existing DetectLoadedModule() flow which already diffs the module list on each stop.

    When modules change:

    • New module appears → fetch its symbols from the backend
    • Module disappears → discard its symbols
    • Module still present → keep symbols, no work needed

    Adding symbols to the BinaryView:

    • Create FunctionSymbol for each backend symbol (e.g., exports like CreateFileA)
    • Short name: CreateFileA, full name: kernel32!CreateFileA
    • Also create a data variable at each address with type void — this is needed for BN to actually render the symbol in views
    • Use DefineAutoSymbol (not DefineUserSymbol) so they don't override user-defined symbols

    Cleanup on debug stop: Track all addresses where backend symbols were added (similar to existing m_addressesWithVariable / m_addressesWithComment pattern). On TargetExitedEventType / DetachedEventType, iterate and call UndefineAutoSymbol + UndefineDataVariable for each.

    Performance: For large modules (e.g., ntdll with thousands of exports), wrap bulk symbol addition in SetFunctionAnalysisUpdateDisabled(true/false) to avoid per-symbol analysis notification overhead.

    Adapter capability: Add DebugAdapterSupportSymbols to DebugAdapterCapacity enum, or just add a virtual method with a default empty return:

    virtual std::vector<DebugSymbol> GetSymbolsForModule(const DebugModule& module) { return {}; }

    Symbol lookup: O(log n) — find the containing module first (existing GetModuleForAddress()), then binary search that module's sorted symbol list.
15. xusheng6

    added this to the Krypton milestone on Jun 26, 2026
16. xusheng6

    added

    enhancementNew feature or requestNew feature or request

    functionalitycore functionalities of a debuggercore functionalities of a debugger

    on Jul 3, 2026
17. xusheng6

    added 3 commits that reference this issue on Jul 8, 2026

    Load module symbols from the debugger backend on demand (#210)

    ...

    7869645

    Load module symbols from the debugger backend on demand (#210)

    ...

    813fb0a

    Load module symbols from the debugger backend on demand (#210) (#1115)

    a766958
18. xusheng6

    closed this as completedin #1115on Jul 9, 2026