skynet888 !BEWARE! Deletes post on answer
Reputation: 1
Joined: 12 Apr 2021 Posts: 76
|
Posted: Fri Jan 23, 2026 5:52 am Post subject: Disassembler Won't Show Export Names After Debugging |
|
|
https://www.bilibili.com/video/BV1mwzMBhEjQ
Hey CE wizards and reverse-engineering homies,
Got a head-scratcher here that’s killing my debugging workflow—hoping someone’s run into this and has a fix.
Here’s the setup:
I create a process with the CREATE_SUSPENDED flag (suspended right at launch).
I attach CE and set a breakpoint at ntdll.LdrLoadDll to hook into the DLL loading process. At this point, the disassembler window shows no export function names—totally normal, since the process’s dependent DLLs aren’t fully loaded yet. No complaints here.
The problem kicks off after this:
I remove the LdrLoadDll breakpoint, and the process finishes loading all DLLs smoothly. But the disassembler still won’t display any export names!
The only “fix” I’ve found is reattaching the process—but that wipes all my existing breakpoints. That’s a non-starter for my debugging flow.
A quick note: Please don’t suggest using full Windows Debug Symbols—loading all symbols takes CE a solid 30 minutes every time, and partial loading causes random conflicts with other features. I only need symbols for three DLLs: ntdll.dll, User32.dll, and Qt5Gui.dll.
Has anyone figured out how to force the CE disassembler to refresh and show export names without reattaching the process or loading the entire symbol set?
|
|