CODEWITHSUNDEEP
windowsreverse-engineeringwindbgportable-executable
forsajt
forsajt

Reputation: 897

How to dump all function names of an executable?

Is there a way (preferably command line) to dump all function names (not just exports/imports) of an executable?

The executable in question is a Microsoft EXE/DLL, so it should be possible to get the symbols from Microsoft Symbol Server.

Upvotes: 2

Views: 5374

Answers (2)

Thomas Weller
Thomas Weller

Reputation: 59640

Note that it is Microsoft's decision on how many symbols they want to publish. Just because there's a symbol server does not mean you get private symbols.

You can do it in WinDbg:

  1. Open crash dump ... (not open executable)
  2. Select the DLL/Executable
  3. .symfix
  4. .reload
  5. x *!*

And you can use cdb to do it from command line:

cdb -z "c:\windows\system32\notepad.exe" -c ".symfix;.reload;x *!*;q"

Upvotes: 4

blabb
blabb

Reputation: 9007

x calc!* should dump functions . types and globals for the calculator.exe 

0:000> x calc!*
00bd6b7a          calc!std::locale::locale (<no parameter info>)
00bc1138          calc!_imp__NtQueryLicenseValue = <no type information>
00bf308b          calc!CToolsetDialog::`scalar deleting destructor' (<no parameter info>)
00bc6479          calc!CContainer::IsFocusOnMainDisplayAllowed (<no parameter info>)
00be29b3          calc!CContainer::ToggleHistoryFunc (<no parameter info>)
00bcb3bb          calc!DigitGroupingStringToGroupingNum (<no parameter info>)
00bf2235          calc!RecoveryCallback::IsNextPingRequired (<no parameter info>)
00bd23f8          calc!_Mtxlock (<no parameter info>)
00bc11e8          calc!_imp__InterlockedIncrement = <no type information>
00bc13b4          calc!_imp__DestroyWindow = <no type information>
00c08593          calc!exception::exception (<no parameter info>)
00c03c90          calc!std::operator<<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> > (<no parameter info>)

Upvotes: 2

Related Questions