Created
January 7, 2014 20:47
-
-
Save jesusdesantos/8306629 to your computer and use it in GitHub Desktop.
Getting symbol names from the DLL export table
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// If no symbol information is found because the .pdb is missing we try the alternative | |
// of finding the nearest exported symbol from the DLL. Although it can be inaccurate it is | |
// better than displaying nothing and usually our clients do not have our pdbs because they | |
// send us minidumps. | |
else if (MapAndLoad_ != 0 && UnMapAndLoad_ != 0 && ImageDirectoryEntryToData_ != 0 && | |
ImageRvaToVa_ != 0 && UnDecorateSymbolName_ != 0) | |
{ | |
_LOADED_IMAGE loadedImage; | |
if (MapAndLoad_(moduleInfo.ImageName, 0, &loadedImage, TRUE, TRUE)) | |
{ | |
ULONG size; | |
_IMAGE_EXPORT_DIRECTORY* imageExportDirectory = (_IMAGE_EXPORT_DIRECTORY*) | |
ImageDirectoryEntryToData_(loadedImage.MappedAddress, false, | |
IMAGE_DIRECTORY_ENTRY_EXPORT, &size); | |
if (imageExportDirectory != 0) | |
{ | |
// http://msdn.microsoft.com/en-us/magazine/ms809762.aspx | |
DWORD* names = (DWORD*)ImageRvaToVa_(loadedImage.FileHeader, | |
loadedImage.MappedAddress, imageExportDirectory->AddressOfNames, NULL); | |
WORD* ordinals = (WORD*)ImageRvaToVa_(loadedImage.FileHeader, | |
loadedImage.MappedAddress, imageExportDirectory->AddressOfNameOrdinals, NULL); | |
DWORD* functions = (DWORD*)ImageRvaToVa_(loadedImage.FileHeader, | |
loadedImage.MappedAddress, imageExportDirectory->AddressOfFunctions, NULL); | |
NsUInt32 nearestAddress = 0xffffffff; | |
NsChar* nearestName = 0; | |
for (DWORD i = 0; i < imageExportDirectory->NumberOfNames; i++) | |
{ | |
DWORD64 ptr = functions[ordinals[i]]; | |
DWORD64 rva = (NsByte*)(addr) - (NsByte*)(moduleInfo.BaseOfImage); | |
if (rva >= ptr) | |
{ | |
DWORD64 delta = rva - ptr; | |
if (delta < nearestAddress) | |
{ | |
nearestAddress = NsSize(delta); | |
nearestName = (NsChar *)ImageRvaToVa_(loadedImage.FileHeader, | |
loadedImage.MappedAddress, names[i], NULL); | |
} | |
} | |
} | |
if (nearestAddress != 0xffffffff) | |
{ | |
NsChar undecorated[512]; | |
UnDecorateSymbolName_(nearestName, undecorated, 512, UNDNAME_NAME_ONLY); | |
NsChar lineInfoBuffer[512]; | |
String::FormatBuffer(lineInfoBuffer, 512, "!%s + 0x%x bytes", undecorated, | |
nearestAddress); | |
String::Append(buffer, bufferSize, lineInfoBuffer); | |
} | |
} | |
UnMapAndLoad_(&loadedImage); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment