CODEWITHSUNDEEP
c++winapi
quarks
quarks

Reputation: 35276

Getting class offset in a Win32 binary

For a Win32 Portable Executable (PE)

Upvotes: 0

Views: 364

Answers (1)

Seva Alekseyev
Seva Alekseyev

Reputation: 61341

A class does not have an offset - its methods have offsets. If the PE file is a DLL, and a class is exported, you can get offsets of its methods from the exported function table. The names will be mangled though. The mangling scheme is compiler- and version-specific.

You can use the DUMPBIN tool (available with Visual Studio, or in Platform SDK) to watch the export table. IIRC, it can even unmangle the names for you. If you want to do it programmatically, use the functions from the ImageHlp API - ImageLoad() and so forth.

There's no good way to get offsets of nonexported class methods.

Also, offsets can be found in a MAP file, or in debug symbols, or in a PDB file. If it's a third party product, those won't be available to you, most likely.

EDIT re: Microsoft DLLs. Microsoft makes debug symbols for a lot of their files (both Win32 and .NET) available via the Microsoft Symbol Server. Visual Studio since v. 2005 can pull those symbols automatically upon DLL loading.

Upvotes: 2

Related Questions