Reputation: 15
I am trying to locate a specific function in a .pdb file. Originally I compiled a simple "hello, world" program, and analyzed the name of the functions using the IDiaSymbol::get_name method, but I couldn't locate my function.
After this, I tried including a __declspec(naked) void myFunction(void){}
function in my helloworld.pdb file, in order to use the IDiaSymbol::get_isNaked method to locate my function, however, when I did this, nothing at all was printed - entailing there are no naked functions in my code.
//After initialization, creating instance, etc
IDiaEnumSymbols* pUnknown = NULL;
if (pTable->QueryInterface(__uuidof(IDiaEnumSymbols), (void**) &pUnknown) == S_OK) {
printf("Supports Symbol module\n");
CComPtr<IDiaSymbol> pSymbol;
int counter = 0;
for (LONG i = 0; i < blongTableCount; i++)
{
if (pUnknown->Item(i, &pSymbol) != S_OK) {
fprintf(stderr, "Error: pUnknown->Item");
}
BOOL isFunction;
if (pSymbol->get_function(&isFunction) == S_OK) {
if (isFunction == TRUE) {
counter += 1;
printf("Number of functions: %d", counter);
//With the following I could not find my functions
BSTR symName;
if (pSymbol->get_name(&symName) == S_OK) {
printf("Name of symbol: %S\n", symName);
}
//Check for naked functions - I included a declspec(naked) function for testing.
BOOL pFlag;
if (pSymbol->get_isNaked(&pFlag) == S_OK) {
printf("This is a naked function");
}
}
}
pSymbol = NULL;
}
}
EDIT: Included my simple .pdb program below (was a "hello world program", now contains a simple __declspec(naked) function):
#include <iostream>
__declspec(naked) void myFunction(void) {
__asm {
ret
}
}
int main()
{
myFunction();
return 0;
}
What I expected from parsing the symbol table: The same results you would get when parsing an ELF file on *NIX - a symbol table containing the actual names I wrote for my function, so something like ".text myFunction"
What is actually printed out: Many Winapi functions and other assembler created functions, probably due to optimizing out of my function.
Example:
Name of symbol: main
Name of symbol: __acrt_thread_attach
Name of symbol: _RTC_NumErrors
Name of symbol: ReadNoFence64
Name of symbol: __setusermatherr
Name of symbol: _RTC_SetErrorFuncW
Name of symbol: IsProcessorFeaturePresent
Name of symbol: GetLastError
Name of symbol: __acrt_initialize
Upvotes: 0
Views: 81