Skip to content

Instantly share code, notes, and snippets.

@jesusdesantos
Created January 7, 2014 20:47
Show Gist options
  • Save jesusdesantos/8306629 to your computer and use it in GitHub Desktop.
Save jesusdesantos/8306629 to your computer and use it in GitHub Desktop.
Getting symbol names from the DLL export table
// If no symbol information is found because the .pdb is missing we try the alternative
// of finding the nearest exported symbol from the DLL. Although it can be inaccurate it is
// better than displaying nothing and usually our clients do not have our pdbs because they
// send us minidumps.
else if (MapAndLoad_ != 0 && UnMapAndLoad_ != 0 && ImageDirectoryEntryToData_ != 0 &&
ImageRvaToVa_ != 0 && UnDecorateSymbolName_ != 0)
{
_LOADED_IMAGE loadedImage;
if (MapAndLoad_(moduleInfo.ImageName, 0, &loadedImage, TRUE, TRUE))
{
ULONG size;
_IMAGE_EXPORT_DIRECTORY* imageExportDirectory = (_IMAGE_EXPORT_DIRECTORY*)
ImageDirectoryEntryToData_(loadedImage.MappedAddress, false,
IMAGE_DIRECTORY_ENTRY_EXPORT, &size);
if (imageExportDirectory != 0)
{
// http://msdn.microsoft.com/en-us/magazine/ms809762.aspx
DWORD* names = (DWORD*)ImageRvaToVa_(loadedImage.FileHeader,
loadedImage.MappedAddress, imageExportDirectory->AddressOfNames, NULL);
WORD* ordinals = (WORD*)ImageRvaToVa_(loadedImage.FileHeader,
loadedImage.MappedAddress, imageExportDirectory->AddressOfNameOrdinals, NULL);
DWORD* functions = (DWORD*)ImageRvaToVa_(loadedImage.FileHeader,
loadedImage.MappedAddress, imageExportDirectory->AddressOfFunctions, NULL);
NsUInt32 nearestAddress = 0xffffffff;
NsChar* nearestName = 0;
for (DWORD i = 0; i < imageExportDirectory->NumberOfNames; i++)
{
DWORD64 ptr = functions[ordinals[i]];
DWORD64 rva = (NsByte*)(addr) - (NsByte*)(moduleInfo.BaseOfImage);
if (rva >= ptr)
{
DWORD64 delta = rva - ptr;
if (delta < nearestAddress)
{
nearestAddress = NsSize(delta);
nearestName = (NsChar *)ImageRvaToVa_(loadedImage.FileHeader,
loadedImage.MappedAddress, names[i], NULL);
}
}
}
if (nearestAddress != 0xffffffff)
{
NsChar undecorated[512];
UnDecorateSymbolName_(nearestName, undecorated, 512, UNDNAME_NAME_ONLY);
NsChar lineInfoBuffer[512];
String::FormatBuffer(lineInfoBuffer, 512, "!%s + 0x%x bytes", undecorated,
nearestAddress);
String::Append(buffer, bufferSize, lineInfoBuffer);
}
}
UnMapAndLoad_(&loadedImage);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment