Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data

Question

How can I find only real functions not data garbage like section..debug_S_105 ? *

I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln file was provided).

For example I generated cryptopp library --> opened provided cryptest.sln and built it (Win32, Release, /O2) which produces some files:
- Object files: 3way.obj, adler32.obj, algebra.obj,
- Lib file: cryptlib.lib
- PDB file: cryptlib.pdb

I need to know the function name and get the assembler code:

xxxx ✗ r2 authenc.obj
[0x0000368d]> aaaa
[Cannot analyze at 0x00010bdeg with sym. and entry0 (aa)
Cannot analyze at 0x00010be2
Cannot analyze at 0x00010c08
Cannot analyze at 0x00010c08
Cannot analyze at 0x00010c1a
Cannot analyze at 0x00010c1a
Cannot analyze at 0x00010d28
Cannot analyze at 0x00010d28
Cannot analyze at 0x0001114e
Cannot analyze at 0x0001114e
[...]
Cannot analyze at 0x000111fd
Cannot analyze at 0x000111fd
Cannot analyze at 0x00011211
Cannot analyze at 0x00011211
Cannot analyze at 0x0001126f
Cannot analyze at 0x0001126f
Cannot analyze at 0x00011283
Cannot analyze at 0x00011283
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Finding function preludes
[x] Enable constraint types analysis for variables
[0x0000368d]> afl
0x0000368d    5 63           sym.____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2__0___QAV10_0_Z
0x00000000   45 877  -> 848  sym._comp.id
0x00001b44  286 1517 -> 1781 sym..drectve
0x00003619   62 851  -> 946  sym..debug_T
0x00003980   25 601  -> 640  section..debug_S_6
0x00003c15   81 872  -> 951  section..debug_S_8
0x000040e7    3 25           sym.__unwindfunclet_____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D
0x00004143    5 34           sym.____Allocate__07U_Default_allocate_traits_std___0A__std__YAPAXI_Z
0x00004179   20 447  -> 510  section..debug_S_11
0x000043a7   16 291  -> 307  sym.____Allocate_manually_vector_aligned_U_Default_allocate_traits_std___std__YAPAXI_Z
0x000046a8    3 44           sym.____Deallocate__07_0A__std__YAXPAXI_Z
0x000046e8   19 638  -> 633  section..debug_S_15
0x000049a2   91 1191 -> 1310 section..debug_S_17
0x000051f4    6 134          sym.____Reallocate_grow_by_V_lambda_67d87d4aa1269033985980465fd1d824_____V___basic_string_DU__char_traits_D_std__V__allocator_D_2
0x000052b6   77 2130 -> 2150 section..debug_S_19
0x00005b58   98 1887 -> 1975 section..debug_S_21
0x0000644a    1 46           sym.__0__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAE___QAV01__Z
0x00006478   38 1037 -> 1080 section..debug_S_23
0x00006899   14 258  -> 254  fcn.00006899
0x00006a73    1 172          sym.__0BadState_AuthenticatedSymmetricCipher_CryptoPP__QAE_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__PBD1_Z
0x00006bbf  275 1521 -> 1789 section..debug_S_27
0x000073a9    8 138  -> 140  fcn.000073a9
0x0000743e    1 105          sym.__0BadState_AuthenticatedSymmetricCipher_CryptoPP__QAE_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__PBD_Z
0x0000750b  152 971  -> 1135 section..debug_S_30
0x00007a6d    4 184          fcn.00007a6d
0x00007b61   37 453  -> 508  section..debug_S_33
0x00007ef3    3 142          sym.__unwindfunclet___0Exception_CryptoPP__QAE_ABV01__Z_0
0x00007fb3   92 797  -> 928  section..debug_S_36
0x00008409    3 106          sym.__unwindfunclet___0Exception_CryptoPP__QAE_W4ErrorType_01_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std___Z
0x00008487   23 491  -> 519  section..debug_S_39
0x00008686   19 559  -> 578  section..debug_S_41
0x000088c9  136 2578 -> 2731 section..debug_S_43
0x0000913c   12 415  -> 432  section..debug_S_53
0x000092f9   64 1036 -> 1135 section..debug_S_55
0x00009817    3 31           sym.___GBadState_AuthenticatedSymmetricCipher_CryptoPP__UAEPAXI_Z
0x0000984a   42 417  -> 504  section..debug_S_57
0x000099ff   26 377  -> 423  section..debug_S_59
0x00009b8c   25 404  -> 418  section..debug_S_61
0x00009d3e   20 355  -> 378  section..debug_S_63
0x00009ec8   16 188          sym._AuthenticateData_AuthenticatedSymmetricCipherBase_CryptoPP__IAEXPBEI_Z
0x00009fa2   64 2101 -> 2160 section..debug_S_65
0x0000a881  204 1185 -> 1293 section..debug_S_67
0x0000b213    8 287          sym.__unwindfunclet__ProcessData_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPAEPBEI_Z_3
0x00000068   51 773  -> 769  fcn.00000068
0x00000008   45 869  -> 840  fcn.00000008
0x0000b38c   69 597  -> 711  section..debug_S_70
0x0000b7e2    8 164  -> 166  sym.__unwindfunclet__Resynchronize_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEH_Z_0
0x0000b890   76 1581 -> 1597 section..debug_S_73
0x0000bfd5  596 2248 -> 2834 section..debug_S_75
0x0000cdaf   20 396          sym.__unwindfunclet__TruncatedFinal_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPAEI_Z_7
0x0000cf4c   13 177          sym._Update_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEI_Z
0x0000d061   82 625  -> 706  section..debug_S_78
0x0000d53f   42 867  -> 896  sym..text_x
0x0000d8b6   52 818  -> 948  section..debug_S_83
0x0000dbe8   54 928  -> 1018 section..debug_S_85
0x0000df9c   55 1312 -> 1363 section..debug_S_87
0x0000e4c6   26 685  -> 727  section..debug_S_89
0x0000e787   11 165  -> 168  fcn.0000e787
0x0000e8e9    1 11           sym.__Xran____String_val_U___Simple_types_D_std___std__SAXXZ
0x0000e908   19 352  -> 382  section..debug_S_93
0x0000ea72   28 525  -> 551  section..debug_S_95
0x0000ed10    3 31           sym._append___basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAEAAV12_QBD_Z
0x0000ed39   35 651  -> 697  section..debug_S_97
0x0000efd8   66 968  -> 1055 section..debug_S_99
0x0000f49e    3 30           sym._insert___basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAEAAV12_IABV12__Z
0x0000f4c6   34 954  -> 976  section..debug_S_101
0x0000f8b2   15 381  -> 395  section..debug_S_103
0x00010050    8 66           sym._reserve___basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAEXI_Z
0x000100a6   68 958  -> 1063 section..debug_S_105
0x00010464   17 556  -> 578  section..debug_S_107
0x0001069a    9 359  -> 360  section..debug_S_109
0x00004100    6 101          sym.__ehhandler_____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2__0
0x00010808    1 57           sym.__ehfuncinfo___0Exception_CryptoPP__QAE_W4ErrorType_01_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std___Z
0x00010848    1 57           sym.__ehfuncinfo___0Exception_CryptoPP__QAE_ABV01__Z
0x00010888    1 57           sym.__ehfuncinfo_____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2
0x000108d0    1 67           fcn.000108d0
0x00010932    1 87           sym.__ehfuncinfo___0BadState_AuthenticatedSymmetricCipher_CryptoPP__QAE_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2
0x00010990    1 57           sym.__ehfuncinfo__Resynchronize_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEH_Z
0x000109d0    1 57           sym.__ehfuncinfo__Update_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEI_Z
0x00010a28    1 122          sym.__ehfuncinfo__ProcessData_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPAEPBEI_Z
0x00010c40    1 12           sym.__CT___R0_AVexception_std___8__0exception_std__QAE_ABV01__Z12
0x00010c70    5 149          sym.___C__02LMMGGCAJ__3_5
0x00010d53    1 12           sym.__CT___R0_AVException_CryptoPP___8__0Exception_CryptoPP__QAE_ABV01__Z40
0x00010d83   22 421  -> 456  section..xdata_x_131
0x00010f4b    1 122          sym.___R4InvalidArgument_CryptoPP__6B
0x00010fe8   24 285  -> 312  sym.___R4BadState_AuthenticatedSymmetricCipher_CryptoPP__6B
0x0001111e    1 12           sym..xdata_x
0x00011292   72 551  -> 631  section..debug_S_169
0x00000e92    3 78           fcn.00000e92

I m using Python for extraction but some of these functions are not real function for example: section..debug_S_105

What do I have to do in detail to avoid the data garbage and just find real functions (like in source code)? Or did I compile the source code wrong?

Answer 1

from your paste above I presume
You Want to get this data from the object files ( *.obj ) and not from the compiled and linked executable

if yes then COFF (component object file format ) is pretty well documented all you need to parse is COFF SYMBOL TABLE

you can use dumpbin /SYMBOLS to look for all functions

C:\Users\xx\source\repos\dumpfuncs>dumpbin /symbols dumpfuncs.obj | grep -i (

Microsoft (R) COFF/PE Dumper Version 14.16.27035.0

Copyright (C) Microsoft Corporation.  All rights reserved.

010 00000000 SECT5  notype ()    External     | ?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void))
011 00000010 SECT5  notype ()    External     | ?FileName@@YAPADXZ (char * __cdecl FileName(void))
012 00000020 SECT5  notype ()    External     | _main

Raw Parsing of an obj file with a hex dumper (xxd.exe)

:\>xxd -v 
xxd v1.11, 8 jun 2013 by Juergen Weigert et al.  <<<<< has little endian switch -e   

COFF_SYMBOL_TABLE is at offset 8 in COFF HEADER followed by number of symbols

:\>xxd.exe -e -l 8 -g 4 -s 8 dumpfuncs.obj
00000008: 000048c0 00000015                    .H......

keep dumping 0x12 bytes for each symbol and their aux records if any

SYMBOL 1

:\>xxd -g 1 -c 18 -s 0x48c0 -l 18 dumpfuncs.obj
000048c0: 40 63 6f 6d 70 2e 69 64 9b 69 05 01 ff ff 00 00 03 00  @comp.id.i........

SYMBOL 2

:\>xxd -g 1 -c 18 -s 0x48d2 -l 18 dumpfuncs.obj
000048d2: 40 66 65 61 74 2e 30 30 91 01 00 80 ff ff 00 00 03 00  @feat.00..........

SYMBOL 3,4

:\>xxd -g 1 -c 18 -s 0x48e4 -l 18 dumpfuncs.obj
000048e4: 2e 64 72 65 63 74 76 65 00 00 00 00 01 00 00 00 03 01  .drectve..........

:\>echo one auxillary record follows (last byte is 01) do not count as symbol
:\>xxd -g 1 -c 18 -s 0x48f6 -l 18 dumpfuncs.obj
000048f6: 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ..................

SYMBOL 5,6

:\>xxd -g 1 -c 18 -s 0x4908 -l 18 dumpfuncs.obj
00004908: 2e 64 65 62 75 67 24 53 00 00 00 00 02 00 00 00 03 01  .debug$S..........
:\>xxd -g 1 -c 18 -s 0x491a -l 18 dumpfuncs.obj
0000491a: 50 45 00 00 15 00 00 00 00 00 00 00 00 00 00 00 00 00  PE................

SYMBOL 7,8

:\>xxd -g 1 -c 18 -s 0x492c -l 18 dumpfuncs.obj
0000492c: 2e 64 65 62 75 67 24 54 00 00 00 00 03 00 00 00 03 01  .debug$T..........
:\>xxd -g 1 -c 18 -s 0x493e -l 18 dumpfuncs.obj
0000493e: 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  L.................

SYMBOL 9,0xa

:\>xxd -g 1 -c 18 -s 0x4950 -l 18 dumpfuncs.obj
00004950: 2e 72 64 61 74 61 00 00 00 00 00 00 04 00 00 00 03 01  .rdata............
:\>xxd -g 1 -c 18 -s 0x4962 -l 18 dumpfuncs.obj
00004962: 0e 00 00 00 00 00 00 00 ad 41 9d c2 00 00 00 00 00 00  .........A........

SYMBOL 0xb

:\>xxd -g 1 -c 18 -s 0x4974 -l 18 dumpfuncs.obj
00004974: 24 53 47 38 39 31 38 32 00 00 00 00 04 00 00 00 03 00  $SG89182..........

SYMBOL 0xc,----0x13

:\>xxd -g 1 -c 18 -s 0x4986 -l 18 dumpfuncs.obj
00004986: 2e 74 65 78 74 24 6d 6e 00 00 00 00 05 00 00 00 03 01  .text$mn..........
:\>xxd -g 1 -c 18 -s 0x4998 -l 18 dumpfuncs.obj
00004998: 43 00 00 00 06 00 00 00 7d 5c d3 64 00 00 00 00 00 00  C.......}\.d......

the six relocations in section #5 whose size of rawdata is 43 
the start and end address of section Raw Data is in COFF_HEADER

:\>xxd -g 1 -c 18 -s 0x49aa -l 18 dumpfuncs.obj
000049aa: 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 02 00  ..................
:\>xxd -g 1 -c 18 -s 0x49bc -l 18 dumpfuncs.obj
000049bc: 00 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 02 00  ..................
:\>xxd -g 1 -c 18 -s 0x49ce -l 18 dumpfuncs.obj
000049ce: 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00  ....2.............
:\>xxd -g 1 -c 18 -s 0x49e0 -l 18 dumpfuncs.obj
000049e0: 00 00 00 00 48 00 00 00 00 00 00 00 05 00 20 00 02 00  ....H......... ...

:\>echo the 20 denotes a function in section #5 name of function is at 0x48 from string table

:\>xxd -g 1 -c 18 -s 0x49f2 -l 18 dumpfuncs.obj
000049f2: 00 00 00 00 58 00 00 00 10 00 00 00 05 00 20 00 02 00  ....X......... ...
:\>echo funcname @58 in section 5 10 bytes from start

:\>xxd -g 1 -c 18 -s 0x4a04 -l 18 dumpfuncs.obj
00004a04: 5f 6d 61 69 6e 00 00 00 20 00 00 00 05 00 20 00 02 00  _main... ..... ...
:\>echo main() starts at offset 20 insection #5

SYMBOL 0x14,0x15

:\>xxd -g 1 -c 18 -s 0x4a16 -l 18 dumpfuncs.obj
00004a16: 2e 63 68 6b 73 36 34 00 00 00 00 00 06 00 00 00 03 01  .chks64...........
:\>xxd -g 1 -c 18 -s 0x4a28 -l 18 dumpfuncs.obj
00004a28: 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  0.................

:>echo 0x15 symbols and thier aux records are over now string table starts

:\>xxd -e -g 4 -s 0x4a3a -l 4 dumpfuncs.obj
00004a3a: 0000006b                             k...

:\>echo size of string table 0x6b

:\>xxd -e -g 1 -s 0x4a3a -l 0x6b dumpfuncs.obj
00004a3a: 6b 00 00 00 5f 5f 69 6d 70 5f 5f 47 65 74 43 6f  k...__imp__GetCo
00004a4a: 6d 6d 61 6e 64 4c 69 6e 65 41 40 30 00 5f 5f 69  mmandLineA@0.__i
00004a5a: 6d 70 5f 5f 45 78 69 74 50 72 6f 63 65 73 73 40  mp__ExitProcess@
00004a6a: 34 00 5f 5f 69 6d 70 5f 5f 4d 65 73 73 61 67 65  4.__imp__Message
00004a7a: 42 6f 78 41 40 31 36 00 3f 43 6d 64 4c 6e 40 40  BoxA@16.?CmdLn@@
00004a8a: 59 41 50 41 44 58 5a 00 3f 46 69 6c 65 4e 61 6d  YAPADXZ.?FileNam
00004a9a: 65 40 40 59 41 50 41 44 58 5a 00                 e@@YAPADXZ.

The Demangled Name of Function At offset 0x48 from string table start

:\>xxd -g 1 -s 0x4a82 -l 0x10 dumpfuncs.obj
00004a82: 3f 43 6d 64 4c 6e 40 40 59 41 50 41 44 58 5a 00  ?CmdLn@@YAPADXZ.

unmangled name

:\>vc++filt
?CmdLn@@YAPADXZ
char * __cdecl CmdLn(void)
^C

Section #5 Header and Raw Data

:\>xxd -g 4 -c 4 -e  -s 0xb4 -l 0x28 dumpfuncs.obj
000000b4: 7865742e  .tex
000000b8: 6e6d2474  t$mn
000000bc: 00000000  ....
000000c0: 00000000  ....
000000c4: 00000043  C...
000000c8: 00004811  .H..
000000cc: 00004854  TH..
000000d0: 00000000  ....
000000d4: 00000006  ....
000000d8: 60500020   .P`

:\>xxd -g 1 -s 0x4811 -l 0x43 dumpfuncs.obj
00004811: 55 8b ec ff 15 00 00 00 00 5d c3 cc cc cc cc cc  U........]......
00004821: 55 8b ec b8 00 00 00 00 5d c3 cc cc cc cc cc cc  U.......].......
00004831: 55 8b ec 6a 00 e8 00 00 00 00 50 e8 00 00 00 00  U..j......P.....
00004841: 50 6a 00 ff 15 00 00 00 00 6a 00 ff 15 00 00 00  Pj.......j......
00004851: 00 5d c3                                         .].

:\>echo notice the push ebp prolog
notice the push ebp prolog

Raw Data Dis Assembled

>dumpbin /disasm dumpfuncs.obj


?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void)):
  00000000: 55                 push        ebp
  00000001: 8B EC              mov         ebp,esp
  00000003: FF 15 00 00 00 00  call        dword ptr [__imp__GetCommandLineA@0]
  00000009: 5D                 pop         ebp
  0000000A: C3                 ret
  0000000B: CC                 int         3
  0000000C: CC                 int         3
  0000000D: CC                 int         3
  0000000E: CC                 int         3
  0000000F: CC                 int         3
?FileName@@YAPADXZ (char * __cdecl FileName(void)):
  00000010: 55                 push        ebp
  00000011: 8B EC              mov         ebp,esp
  00000013: B8 00 00 00 00     mov         eax,offset $SG89182
  00000018: 5D                 pop         ebp
  00000019: C3                 ret
  0000001A: CC                 int         3
  0000001B: CC                 int         3
  0000001C: CC                 int         3
  0000001D: CC                 int         3
  0000001E: CC                 int         3
  0000001F: CC                 int         3
_main:
  00000020: 55                 push        ebp
  00000021: 8B EC              mov         ebp,esp
  00000023: 6A 00              push        0
  00000025: E8 00 00 00 00     call        ?FileName@@YAPADXZ
  0000002A: 50                 push        eax
  0000002B: E8 00 00 00 00     call        ?CmdLn@@YAPADXZ
  00000030: 50                 push        eax
  00000031: 6A 00              push        0
  00000033: FF 15 00 00 00 00  call        dword ptr [__imp__MessageBoxA@16]
  00000039: 6A 00              push        0
  0000003B: FF 15 00 00 00 00  call        dword ptr [__imp__ExitProcess@4]
  00000041: 5D                 pop         ebp
  00000042: C3                 ret

the source used for compiling and linking with vs 2017

#include <windows.h>
#pragma comment(lib,"user32.lib")
#pragma comment(lib,"kernel32.lib")

__declspec ( noinline ) LPSTR CmdLn(void) {
    return GetCommandLineA();
}
__declspec ( noinline ) LPSTR FileName (void) {
    return __FILE__;
}
int main(void) 
{
    MessageBoxA(NULL,CmdLn(),FileName(), MB_OK);
    ExitProcess(NULL);
}

compiled and linked with

cl /Zi /W4 /analyze /EHsc /nologo /Od %1.cpp /link /release /subsystem:windows /entry:main