我想以与 windbg 的 dt 命令相同的方式转储结构的字段和偏移量。例如，假设我想转储 Microsoft Public 符号中的 _PEB 结构（因为 windbg 的 DT 命令有效）。
从 MSDN 文档中，我了解到 SymFromName 函数应该能够做到这一点，下面是我尝试过的代码，它在 SymFromName 上失败，LastError 126（找不到指定的模块）。从注册的回调中，我得到以下输出：
CBA_SET_OPTIONS
CBA_SET_OPTIONS
CBA_SET_OPTIONS
CBA_EVENT: code 0 desc DBGHELP: Symbol Search Path: symsrv*symsrv.dll*C:\Symbols*http://msdl.microsoft.com/download/symbols
DBGHELP: Symbol Search Path: symsrv*symsrv.dll*C:\Symbols*http://msdl.microsoft.com/download/symbols
CBA_DEFERRED_SYMBOL_LOAD_START: C:\Windows\Sysnative\ntdll.dll
CBA_DEFERRED_SYMBOL_LOAD_PARTIAL: C:\Windows\Sysnative\ntdll.dll
CBA_EVENT: code 0 desc DBGHELP: No header for C:\Windows\Sysnative\ntdll.dll. Searching for image on disk
DBGHELP: No header for C:\Windows\Sysnative\ntdll.dll. Searching for image on disk
CBA_EVENT: code 0 desc DBGHELP: C:\Windows\Sysnative\ntdll.dll - OK
DBGHELP: C:\Windows\Sysnative\ntdll.dll - OK
CBA_DEFERRED_SYMBOL_LOAD_COMPLETE: C:\Windows\Sysnative\ntdll.dll
CBA_EVENT: code 0 desc DBGHELP: ntdll - public symbols
C:\Symbols\ntdll.pdb\823B51C37A764AF7BA1558B42B627FAC2\ntdll.pdb
DBGHELP: ntdll - public symbols
C:\Symbols\ntdll.pdb\823B51C37A764AF7BA1558B42B627FAC2\ntdll.pdb
编码：
const
Index: THandle =1;
Size = (SizeOf(SYMBOL_INFO)-1 + MAX_SYM_NAME * SizeOf(TCHAR) + SizeOf(ULONG64) -1) div SizeOf(ULONG64);
var
Symbol: String;
Filename: String;
Path: String;
dwBaseAddress: DWORD;
im: IMAGEHLP_MODULE64;
Buffer: array[0..Size] of ULONG64;
pSymbol: PSYMBOL_INFO;
SymbolName: array[0..MAX_SYM_NAME-1] of Char;
begin
ZeroMemory(@SymbolName, SizeOf(SymbolName));
SymbolName := '_PEB';
Filename := 'C:\Windows\Sysnative\ntdll.dll';
Path := 'symsrv*symsrv.dll*C:\Symbols*http://msdl.microsoft.com/download/symbols';
{ Initialize }
Win32Check(SymInitialize(Index, nil, False));
{ Register callback to get some debug info }
Win32Check(SymRegisterCallback64(Index, DbgHelpCallback, 0));
{ Set Options }
SymSetOptions(SymGetOptions or SYMOPT_UNDNAME);
SymSetOptions(SymGetOptions or SYMOPT_DEBUG);
SymSetOptions(SymGetOptions or SYMOPT_LOAD_ANYTHING);
{ Set Symbol Path }
Win32Check(SymSetSearchPathW(Index, PChar(Path)));
{ Load Module }
dwBaseAddress := SymLoadModuleExW(Index, 0, PChar(Filename), nil, 0, 0, nil, 0);
Win32Check(dwBaseAddress > 0);
ZeroMemory(@im, SizeOf(im));
im.SizeOfStruct := SizeOf(im);
Win32Check(SymGetModuleInfoW64(Index, dwBaseAddress, im));
ZeroMemory(@Buffer, SizeOf(Buffer));
pSymbol := PSYMBOL_INFO(@Buffer);
pSymbol^.SizeOfStruct := SizeOf(SYMBOL_INFO);
pSymbol^.MaxNameLen := MAX_SYM_NAME;
Win32Check(SymFromNameW(Index, Symbolname, pSymbol));
Win32Check(SymUnloadModule64(Index, dwBaseAddress));
Win32Check(SymCleanup(Index));