compiled and linked with
cl /Zi /W4 /analyze /EHsc /nologo /Od %1.cpp /link /release /subsystem:windows /entry:main
compiled and linked with
cl /Zi /W4 /analyze /EHsc /nologo /Od %1.cpp /link /release /subsystem:windows /entry:main
Raw Parsing of an obj file with a hex dumper (xxd.exe)
:\>xxd -v
xxd v1.11, 8 jun 2013 by Juergen Weigert et al. <<<<< has little endian switch -e
COFF_SYMBOL_TABLE is at offset 8 in COFF HEADER followed by number of symbols
:\>xxd.exe -e -l 8 -g 4 -s 8 dumpfuncs.obj
00000008: 000048c0 00000015 .H......
keep dumping 0x12 bytes for each symbol and their aux records if any
SYMBOL 1
:\>xxd -g 1 -c 18 -s 0x48c0 -l 18 dumpfuncs.obj
000048c0: 40 63 6f 6d 70 2e 69 64 9b 69 05 01 ff ff 00 00 03 00 @comp.id.i........
SYMBOL 2
:\>xxd -g 1 -c 18 -s 0x48d2 -l 18 dumpfuncs.obj
000048d2: 40 66 65 61 74 2e 30 30 91 01 00 80 ff ff 00 00 03 00 @feat.00..........
SYMBOL 3,4
:\>xxd -g 1 -c 18 -s 0x48e4 -l 18 dumpfuncs.obj
000048e4: 2e 64 72 65 63 74 76 65 00 00 00 00 01 00 00 00 03 01 .drectve..........
:\>echo one auxillary record follows (last byte is 01) do not count as symbol
:\>xxd -g 1 -c 18 -s 0x48f6 -l 18 dumpfuncs.obj
000048f6: 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..................
SYMBOL 5,6
:\>xxd -g 1 -c 18 -s 0x4908 -l 18 dumpfuncs.obj
00004908: 2e 64 65 62 75 67 24 53 00 00 00 00 02 00 00 00 03 01 .debug$S..........
:\>xxd -g 1 -c 18 -s 0x491a -l 18 dumpfuncs.obj
0000491a: 50 45 00 00 15 00 00 00 00 00 00 00 00 00 00 00 00 00 PE................
SYMBOL 7,8
:\>xxd -g 1 -c 18 -s 0x492c -l 18 dumpfuncs.obj
0000492c: 2e 64 65 62 75 67 24 54 00 00 00 00 03 00 00 00 03 01 .debug$T..........
:\>xxd -g 1 -c 18 -s 0x493e -l 18 dumpfuncs.obj
0000493e: 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 L.................
SYMBOL 9,0xa
:\>xxd -g 1 -c 18 -s 0x4950 -l 18 dumpfuncs.obj
00004950: 2e 72 64 61 74 61 00 00 00 00 00 00 04 00 00 00 03 01 .rdata............
:\>xxd -g 1 -c 18 -s 0x4962 -l 18 dumpfuncs.obj
00004962: 0e 00 00 00 00 00 00 00 ad 41 9d c2 00 00 00 00 00 00 .........A........
SYMBOL 0xb
:\>xxd -g 1 -c 18 -s 0x4974 -l 18 dumpfuncs.obj
00004974: 24 53 47 38 39 31 38 32 00 00 00 00 04 00 00 00 03 00 $SG89182..........
SYMBOL 0xc,----0x13
:\>xxd -g 1 -c 18 -s 0x4986 -l 18 dumpfuncs.obj
00004986: 2e 74 65 78 74 24 6d 6e 00 00 00 00 05 00 00 00 03 01 .text$mn..........
:\>xxd -g 1 -c 18 -s 0x4998 -l 18 dumpfuncs.obj
00004998: 43 00 00 00 06 00 00 00 7d 5c d3 64 00 00 00 00 00 00 C.......}\.d......
the six relocations in section #5 whose size of rawdata is 43
the start and end address of section Raw Data is in COFF_HEADER
:\>xxd -g 1 -c 18 -s 0x49aa -l 18 dumpfuncs.obj
000049aa: 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................
:\>xxd -g 1 -c 18 -s 0x49bc -l 18 dumpfuncs.obj
000049bc: 00 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................
:\>xxd -g 1 -c 18 -s 0x49ce -l 18 dumpfuncs.obj
000049ce: 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00 ....2.............
:\>xxd -g 1 -c 18 -s 0x49e0 -l 18 dumpfuncs.obj
000049e0: 00 00 00 00 48 00 00 00 00 00 00 00 05 00 20 00 02 00 ....H......... ...
:\>echo the 20 denotes a function in section #5 name of function is at 0x48 from string table
:\>xxd -g 1 -c 18 -s 0x49f2 -l 18 dumpfuncs.obj
000049f2: 00 00 00 00 58 00 00 00 10 00 00 00 05 00 20 00 02 00 ....X......... ...
:\>echo funcname @58 in section 5 10 bytes from start
:\>xxd -g 1 -c 18 -s 0x4a04 -l 18 dumpfuncs.obj
00004a04: 5f 6d 61 69 6e 00 00 00 20 00 00 00 05 00 20 00 02 00 _main... ..... ...
:\>echo main() starts at offset 20 insection #5
SYMBOL 0x14,0x15
:\>xxd -g 1 -c 18 -s 0x4a16 -l 18 dumpfuncs.obj
00004a16: 2e 63 68 6b 73 36 34 00 00 00 00 00 06 00 00 00 03 01 .chks64...........
:\>xxd -g 1 -c 18 -s 0x4a28 -l 18 dumpfuncs.obj
00004a28: 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0.................
:>echo 0x15 symbols and thier aux records are over now string table starts
:\>xxd -e -g 4 -s 0x4a3a -l 4 dumpfuncs.obj
00004a3a: 0000006b k...
:\>echo size of string table 0x6b
:\>xxd -e -g 1 -s 0x4a3a -l 0x6b dumpfuncs.obj
00004a3a: 6b 00 00 00 5f 5f 69 6d 70 5f 5f 47 65 74 43 6f k...__imp__GetCo
00004a4a: 6d 6d 61 6e 64 4c 69 6e 65 41 40 30 00 5f 5f 69 mmandLineA@0.__i
00004a5a: 6d 70 5f 5f 45 78 69 74 50 72 6f 63 65 73 73 40 mp__ExitProcess@
00004a6a: 34 00 5f 5f 69 6d 70 5f 5f 4d 65 73 73 61 67 65 4.__imp__Message
00004a7a: 42 6f 78 41 40 31 36 00 3f 43 6d 64 4c 6e 40 40 BoxA@16.?CmdLn@@
00004a8a: 59 41 50 41 44 58 5a 00 3f 46 69 6c 65 4e 61 6d YAPADXZ.?FileNam
00004a9a: 65 40 40 59 41 50 41 44 58 5a 00 e@@YAPADXZ.
The Demangled Name of Function At offset 0x48 from string table start
:\>xxd -g 1 -s 0x4a82 -l 0x10 dumpfuncs.obj
00004a82: 3f 43 6d 64 4c 6e 40 40 59 41 50 41 44 58 5a 00 ?CmdLn@@YAPADXZ.
unmangled name
:\>vc++filt
?CmdLn@@YAPADXZ
char * __cdecl CmdLn(void)
^C
Section #5 Header and Raw Data
:\>xxd -g 4 -c 4 -e -s 0xb4 -l 0x28 dumpfuncs.obj
000000b4: 7865742e .tex
000000b8: 6e6d2474 t$mn
000000bc: 00000000 ....
000000c0: 00000000 ....
000000c4: 00000043 C...
000000c8: 00004811 .H..
000000cc: 00004854 TH..
000000d0: 00000000 ....
000000d4: 00000006 ....
000000d8: 60500020 .P`
:\>xxd -g 1 -s 0x4811 -l 0x43 dumpfuncs.obj
00004811: 55 8b ec ff 15 00 00 00 00 5d c3 cc cc cc cc cc U........]......
00004821: 55 8b ec b8 00 00 00 00 5d c3 cc cc cc cc cc cc U.......].......
00004831: 55 8b ec 6a 00 e8 00 00 00 00 50 e8 00 00 00 00 U..j......P.....
00004841: 50 6a 00 ff 15 00 00 00 00 6a 00 ff 15 00 00 00 Pj.......j......
00004851: 00 5d c3 .].
:\>echo notice the push ebp prolog
notice the push ebp prolog
Raw Data Dis Assembled
>dumpbin /disasm dumpfuncs.obj
?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void)):
00000000: 55 push ebp
00000001: 8B EC mov ebp,esp
00000003: FF 15 00 00 00 00 call dword ptr [__imp__GetCommandLineA@0]
00000009: 5D pop ebp
0000000A: C3 ret
0000000B: CC int 3
0000000C: CC int 3
0000000D: CC int 3
0000000E: CC int 3
0000000F: CC int 3
?FileName@@YAPADXZ (char * __cdecl FileName(void)):
00000010: 55 push ebp
00000011: 8B EC mov ebp,esp
00000013: B8 00 00 00 00 mov eax,offset $SG89182
00000018: 5D pop ebp
00000019: C3 ret
0000001A: CC int 3
0000001B: CC int 3
0000001C: CC int 3
0000001D: CC int 3
0000001E: CC int 3
0000001F: CC int 3
_main:
00000020: 55 push ebp
00000021: 8B EC mov ebp,esp
00000023: 6A 00 push 0
00000025: E8 00 00 00 00 call ?FileName@@YAPADXZ
0000002A: 50 push eax
0000002B: E8 00 00 00 00 call ?CmdLn@@YAPADXZ
00000030: 50 push eax
00000031: 6A 00 push 0
00000033: FF 15 00 00 00 00 call dword ptr [__imp__MessageBoxA@16]
00000039: 6A 00 push 0
0000003B: FF 15 00 00 00 00 call dword ptr [__imp__ExitProcess@4]
00000041: 5D pop ebp
00000042: C3 ret
the source used for compiling and linking with vs 2017
#include <windows.h>
#pragma comment(lib,"user32.lib")
#pragma comment(lib,"kernel32.lib")
__declspec ( noinline ) LPSTR CmdLn(void) {
return GetCommandLineA();
}
__declspec ( noinline ) LPSTR FileName (void) {
return __FILE__;
}
int main(void)
{
MessageBoxA(NULL,CmdLn(),FileName(), MB_OK);
ExitProcess(NULL);
}
Raw Parsing of an obj file with a hex dumper (xxd.exe)
:\>xxd -v
xxd v1.11, 8 jun 2013 by Juergen Weigert et al. <<<<< has little endian switch -e
COFF_SYMBOL_TABLE is at offset 8 in COFF HEADER followed by number of symbols
:\>xxd.exe -e -l 8 -g 4 -s 8 dumpfuncs.obj
00000008: 000048c0 00000015 .H......
keep dumping 0x12 bytes for each symbol and their aux records if any
SYMBOL 1
:\>xxd -g 1 -c 18 -s 0x48c0 -l 18 dumpfuncs.obj
000048c0: 40 63 6f 6d 70 2e 69 64 9b 69 05 01 ff ff 00 00 03 00 @comp.id.i........
SYMBOL 2
:\>xxd -g 1 -c 18 -s 0x48d2 -l 18 dumpfuncs.obj
000048d2: 40 66 65 61 74 2e 30 30 91 01 00 80 ff ff 00 00 03 00 @feat.00..........
SYMBOL 3,4
:\>xxd -g 1 -c 18 -s 0x48e4 -l 18 dumpfuncs.obj
000048e4: 2e 64 72 65 63 74 76 65 00 00 00 00 01 00 00 00 03 01 .drectve..........
:\>echo one auxillary record follows (last byte is 01) do not count as symbol
:\>xxd -g 1 -c 18 -s 0x48f6 -l 18 dumpfuncs.obj
000048f6: 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..................
SYMBOL 5,6
:\>xxd -g 1 -c 18 -s 0x4908 -l 18 dumpfuncs.obj
00004908: 2e 64 65 62 75 67 24 53 00 00 00 00 02 00 00 00 03 01 .debug$S..........
:\>xxd -g 1 -c 18 -s 0x491a -l 18 dumpfuncs.obj
0000491a: 50 45 00 00 15 00 00 00 00 00 00 00 00 00 00 00 00 00 PE................
SYMBOL 7,8
:\>xxd -g 1 -c 18 -s 0x492c -l 18 dumpfuncs.obj
0000492c: 2e 64 65 62 75 67 24 54 00 00 00 00 03 00 00 00 03 01 .debug$T..........
:\>xxd -g 1 -c 18 -s 0x493e -l 18 dumpfuncs.obj
0000493e: 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 L.................
SYMBOL 9,0xa
:\>xxd -g 1 -c 18 -s 0x4950 -l 18 dumpfuncs.obj
00004950: 2e 72 64 61 74 61 00 00 00 00 00 00 04 00 00 00 03 01 .rdata............
:\>xxd -g 1 -c 18 -s 0x4962 -l 18 dumpfuncs.obj
00004962: 0e 00 00 00 00 00 00 00 ad 41 9d c2 00 00 00 00 00 00 .........A........
SYMBOL 0xb
:\>xxd -g 1 -c 18 -s 0x4974 -l 18 dumpfuncs.obj
00004974: 24 53 47 38 39 31 38 32 00 00 00 00 04 00 00 00 03 00 $SG89182..........
SYMBOL 0xc,----0x13
:\>xxd -g 1 -c 18 -s 0x4986 -l 18 dumpfuncs.obj
00004986: 2e 74 65 78 74 24 6d 6e 00 00 00 00 05 00 00 00 03 01 .text$mn..........
:\>xxd -g 1 -c 18 -s 0x4998 -l 18 dumpfuncs.obj
00004998: 43 00 00 00 06 00 00 00 7d 5c d3 64 00 00 00 00 00 00 C.......}\.d......
the six relocations in section #5 whose size of rawdata is 43
the start and end address of section Raw Data is in COFF_HEADER
:\>xxd -g 1 -c 18 -s 0x49aa -l 18 dumpfuncs.obj
000049aa: 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................
:\>xxd -g 1 -c 18 -s 0x49bc -l 18 dumpfuncs.obj
000049bc: 00 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................
:\>xxd -g 1 -c 18 -s 0x49ce -l 18 dumpfuncs.obj
000049ce: 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00 ....2.............
:\>xxd -g 1 -c 18 -s 0x49e0 -l 18 dumpfuncs.obj
000049e0: 00 00 00 00 48 00 00 00 00 00 00 00 05 00 20 00 02 00 ....H......... ...
:\>echo the 20 denotes a function in section #5 name of function is at 0x48 from string table
:\>xxd -g 1 -c 18 -s 0x49f2 -l 18 dumpfuncs.obj
000049f2: 00 00 00 00 58 00 00 00 10 00 00 00 05 00 20 00 02 00 ....X......... ...
:\>echo funcname @58 in section 5 10 bytes from start
:\>xxd -g 1 -c 18 -s 0x4a04 -l 18 dumpfuncs.obj
00004a04: 5f 6d 61 69 6e 00 00 00 20 00 00 00 05 00 20 00 02 00 _main... ..... ...
:\>echo main() starts at offset 20 insection #5
SYMBOL 0x14,0x15
:\>xxd -g 1 -c 18 -s 0x4a16 -l 18 dumpfuncs.obj
00004a16: 2e 63 68 6b 73 36 34 00 00 00 00 00 06 00 00 00 03 01 .chks64...........
:\>xxd -g 1 -c 18 -s 0x4a28 -l 18 dumpfuncs.obj
00004a28: 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0.................
:>echo 0x15 symbols and thier aux records are over now string table starts
:\>xxd -e -g 4 -s 0x4a3a -l 4 dumpfuncs.obj
00004a3a: 0000006b k...
:\>echo size of string table 0x6b
:\>xxd -e -g 1 -s 0x4a3a -l 0x6b dumpfuncs.obj
00004a3a: 6b 00 00 00 5f 5f 69 6d 70 5f 5f 47 65 74 43 6f k...__imp__GetCo
00004a4a: 6d 6d 61 6e 64 4c 69 6e 65 41 40 30 00 5f 5f 69 mmandLineA@0.__i
00004a5a: 6d 70 5f 5f 45 78 69 74 50 72 6f 63 65 73 73 40 mp__ExitProcess@
00004a6a: 34 00 5f 5f 69 6d 70 5f 5f 4d 65 73 73 61 67 65 4.__imp__Message
00004a7a: 42 6f 78 41 40 31 36 00 3f 43 6d 64 4c 6e 40 40 BoxA@16.?CmdLn@@
00004a8a: 59 41 50 41 44 58 5a 00 3f 46 69 6c 65 4e 61 6d YAPADXZ.?FileNam
00004a9a: 65 40 40 59 41 50 41 44 58 5a 00 e@@YAPADXZ.
The Demangled Name of Function At offset 0x48 from string table start
:\>xxd -g 1 -s 0x4a82 -l 0x10 dumpfuncs.obj
00004a82: 3f 43 6d 64 4c 6e 40 40 59 41 50 41 44 58 5a 00 ?CmdLn@@YAPADXZ.
unmangled name
:\>vc++filt
?CmdLn@@YAPADXZ
char * __cdecl CmdLn(void)
^C
Section #5 Header and Raw Data
:\>xxd -g 4 -c 4 -e -s 0xb4 -l 0x28 dumpfuncs.obj
000000b4: 7865742e .tex
000000b8: 6e6d2474 t$mn
000000bc: 00000000 ....
000000c0: 00000000 ....
000000c4: 00000043 C...
000000c8: 00004811 .H..
000000cc: 00004854 TH..
000000d0: 00000000 ....
000000d4: 00000006 ....
000000d8: 60500020 .P`
:\>xxd -g 1 -s 0x4811 -l 0x43 dumpfuncs.obj
00004811: 55 8b ec ff 15 00 00 00 00 5d c3 cc cc cc cc cc U........]......
00004821: 55 8b ec b8 00 00 00 00 5d c3 cc cc cc cc cc cc U.......].......
00004831: 55 8b ec 6a 00 e8 00 00 00 00 50 e8 00 00 00 00 U..j......P.....
00004841: 50 6a 00 ff 15 00 00 00 00 6a 00 ff 15 00 00 00 Pj.......j......
00004851: 00 5d c3 .].
:\>echo notice the push ebp prolog
notice the push ebp prolog
Raw Data Dis Assembled
>dumpbin /disasm dumpfuncs.obj
?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void)):
00000000: 55 push ebp
00000001: 8B EC mov ebp,esp
00000003: FF 15 00 00 00 00 call dword ptr [__imp__GetCommandLineA@0]
00000009: 5D pop ebp
0000000A: C3 ret
0000000B: CC int 3
0000000C: CC int 3
0000000D: CC int 3
0000000E: CC int 3
0000000F: CC int 3
?FileName@@YAPADXZ (char * __cdecl FileName(void)):
00000010: 55 push ebp
00000011: 8B EC mov ebp,esp
00000013: B8 00 00 00 00 mov eax,offset $SG89182
00000018: 5D pop ebp
00000019: C3 ret
0000001A: CC int 3
0000001B: CC int 3
0000001C: CC int 3
0000001D: CC int 3
0000001E: CC int 3
0000001F: CC int 3
_main:
00000020: 55 push ebp
00000021: 8B EC mov ebp,esp
00000023: 6A 00 push 0
00000025: E8 00 00 00 00 call ?FileName@@YAPADXZ
0000002A: 50 push eax
0000002B: E8 00 00 00 00 call ?CmdLn@@YAPADXZ
00000030: 50 push eax
00000031: 6A 00 push 0
00000033: FF 15 00 00 00 00 call dword ptr [__imp__MessageBoxA@16]
00000039: 6A 00 push 0
0000003B: FF 15 00 00 00 00 call dword ptr [__imp__ExitProcess@4]
00000041: 5D pop ebp
00000042: C3 ret
the source used for compiling and linking with vs 2017
#include <windows.h>
#pragma comment(lib,"user32.lib")
#pragma comment(lib,"kernel32.lib")
__declspec ( noinline ) LPSTR CmdLn(void) {
return GetCommandLineA();
}
__declspec ( noinline ) LPSTR FileName (void) {
return __FILE__;
}
int main(void)
{
MessageBoxA(NULL,CmdLn(),FileName(), MB_OK);
ExitProcess(NULL);
}
from your paste above I presume
You Want to get this data from the object files *( .obj ) and not from the compiled and linked executable
if yes then COFF (component object file format ) is pretty well documented all you need to parse is COFF SYMBOL TABLE
you can use dumpbin /SYMBOLS to look for all functions
C:\Users\xx\source\repos\dumpfuncs>dumpbin /symbols dumpfuncs.obj | grep -i (
Microsoft (R) COFF/PE Dumper Version 14.16.27035.0
Copyright (C) Microsoft Corporation. All rights reserved.
010 00000000 SECT5 notype () External | ?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void))
011 00000010 SECT5 notype () External | ?FileName@@YAPADXZ (char * __cdecl FileName(void))
012 00000020 SECT5 notype () External | _main
lang-cpp