利用pdb获取未导出符号

BOOL InitSymHandler(HANDLE hProc)
{
	CHAR SymPath[MAX_PATH], CurDir[MAX_PATH];

	GetCurrentDirectoryA(sizeof(CurDir) / sizeof(CurDir[0]), CurDir);
	SymSetOptions(SYMOPT_DEFERRED_LOADS|SYMOPT_EXACT_SYMBOLS|SYMOPT_CASE_INSENSITIVE|SYMOPT_UNDNAME);
	wsprintfA(SymPath, "SRV*%s\\Symbols*http://msdl.microsoft.com/download/symbols", CurDir);
	return SymInitialize(hProc, SymPath, FALSE);
}

BOOL LoadSymModule(HANDLE hProc, HMODULE hDll)
{
	CHAR szFile[MAX_PATH], SymFile[MAX_PATH];
	MODULEINFO ModInfo;

	GetModuleFileNameA(hDll, szFile, sizeof(szFile) / sizeof(szFile[0]));
	GetModuleInformation(hProc, hDll, &ModInfo, sizeof(ModInfo));
	if (SymGetSymbolFile(hProc, NULL, szFile, sfPdb, SymFile, MAX_PATH, SymFile, MAX_PATH))
	{
		return (SymLoadModule64(hProc, NULL, szFile, NULL, (ULONG_PTR)ModInfo.lpBaseOfDll, ModInfo.SizeOfImage) != 0);
	}
	return FALSE;
}

BOOL CALLBACK SymCallback(PSYMBOL_INFO lpSymInfo, ULONG SymbolSize, PVOID UserContext)
{
	if (lstrcmpA(lpSymInfo->Name, "PsGetNextProcess") == 0)
	{
		DebugBreak();
	}
	return TRUE;
}

int _tmain(int argc, _TCHAR* argv[])
{
	if (InitSymHandler(GetCurrentProcess()))
	{
		HMODULE hDll = LoadLibraryEx(TEXT("ntoskrnl.exe"), NULL, DONT_RESOLVE_DLL_REFERENCES);

		if (LoadSymModule(GetCurrentProcess(), hDll))
		{
			SymEnumSymbols(GetCurrentProcess(), (ULONG_PTR)hDll, NULL, SymCallback, NULL);
		}
		FreeLibrary(hDll);
		SymCleanup(GetCurrentProcess());
	}
	getchar();
	return 0;
}