n4r1b/windbg_wdbootscript

Little script to display the type MpEbGlobasl and the SignaturesDatabase used by WdBoot.

windbg_wdbootscript's Issues

WdBoot symbols

Hi!

I am reading https://www.n4r1b.com/posts/2019/11/understanding-wdboot-windows-defender-elam/ and wondering how you get the symbols for WdBoot into WinDbg? In my debug session, I am not able to load symbols for eithe WdFilter nor WdBoot. Every other module has symbols.

fffff800`23470000 fffff800`23481000   WdBoot     (no symbols) 
fffff800`23a80000 fffff800`23aed000   WdFilter   (no symbols) 

My symbol path:

kd> .sympath
Symbol search path is: cache*c:\symbolcache;SRV*c:\symbols*https://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: cache*c:\symbolcache;srv*c:\symbols*https://msdl.microsoft.com/download/symbols

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       cache*c:\symbolcache
Deferred                                       SRV*c:\symbols*https://msdl.microsoft.com/download/symbols