CODEWITHSUNDEEP
c++windowswinapirustdll
ch271828n
ch271828n

Reputation: 17643

What is "Function Table" provided by dumpbin, and how to manipulate it?

I use dumpbin.exe /ALL myfile.dll and see something interesting:

Function Table (24926)

           Begin    End      Info      Function Name
...

  00001158 000xxxx0 0xxxx277 008AD830  _ZN4core3ptr102drop_in_place$LT$alloc..vec..Vec$LT$vision_utils_rs..algo..rep..row_detect..core_algo..TextRow$GT$$GT$17h0axxxfa922f149aE.llvm.176520069xxxxxx41370
    Unwind version: 1
    Unwind flags: None
    Size of prologue: 0x0E
    Count of codes: 7
    Unwind codes:
      0E: SAVE_XMM128, register=xmm6 offset=0x20
      09: ALLOC_SMALL, size=0x38
      05: PUSH_NONVOL, register=rbx
      04: PUSH_NONVOL, register=rdi
      03: PUSH_NONVOL, register=rsi
      02: PUSH_NONVOL, register=r14

I wonder:

  1. How to remove this Function Name from the .dll file?
  2. How to print this section separately (instead of using /all flag)? I have look through all flags of dumpbin without success.

Thanks for any hints!

Related to: Avoid leaking internal function information: How to correctly detect and strip symbols in Windows dll files? But rephrased since that question focuses on security, while this question asks about facts that I want to learn.

EDIT

Experiment when the pdb file is deliberately renamed.

I deliberately renamed the pdb as follows:

enter image description here

Then execute dumpbin:

$DUMPBIN='C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.31.31103\bin\Hostx64\x64\dumpbin.exe'; $F='C:\Users\xxx\rust\target\release\vision_utils_rs.dll'

  00001158 000401B0 00040277 008AD830  _ZN4core3ptr102drop_in_place$LT$alloc..vec..Vec$LT$vision_utils_rs..algo..rep..row_detect..core_algo..TextRow$GT$$GT$17h0a2856fa922f149aE.llvm.17652006900120541370
... and many more ...

Upvotes: 0

Views: 878

Answers (2)

ch271828n
ch271828n

Reputation: 17643

I found the answer: There is another pdb that this dll file is really pointing to.

As is described in the question, I have temporarily renamed the vision_utils_rs.pdb in the same folder as vision_utils_rs.dll, which are both output artifacts of Rust compilation. Then I thought I was safe and dll will not know about pdb.

However, when I wander around looking at dumpbin /headers myfile.dll, I see:

    622xxxB5 cv            7C 00xxxx84   8Axxx4    Format: RSDS, {3088D8E1-E258-xxxx-BB0F-70B67F466392}, 2, C:\xxx\target\release\deps\vision_utils_rs.pdb

Notice the extra deps folder. So, indeed, when examining the DLL, that deps/vision_utils_rs.pdb is actually what is used to show debug information. Once I rename that, everything is fine.

I am very unfamiliar with Windows systems so made such a silly mistake... Hope this answer helps future people who are facing the same problem!

Upvotes: 0

Anders
Anders

Reputation: 101756

The word "unwind" is your clue that this is related to exceptions. 64-bit Windows uses table based SEH. Unless you want to rewrite your code to not use exceptions nor object destructors, those tables have to stay.

The name of the function however is not required and should go away if there are no symbols and you already have an open question about that so I wont bother with that here.

The command is probably dumpbin /unwindinfo or /pdata.

Upvotes: 2

Related Questions