1

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support.

For that, I need to implement a way to enumerate all functions in a PE binary (EXE) or shared library (DLL). For libraries, iterating exported functions is good enough.

However, I need a way to get a list of functions in the running executable, together with addresses that I can call.

On Linux, I used libelf for this, but I have no idea what to use for PEs.

The target executable is unstripped, but there's no source code.

  • 1
    why do you need to implement this? Isn't it the library user's task to provide proper function addresses? Also, if the executable is "unstripped", does this mean you have debug info? – Igor Skochinsky Apr 24 '17 at 9:24
  • scan the executable for architecture specific function Prologues (e.g. push ebp, mov ebp, esp) - that should be good enough. If you want more sophisticated methods, please referr to the published literature (dissertions etc) – Nordwald Apr 24 '17 at 12:42
  • The executable is unstripped. It has debug info and symbol info. – Zatherz Apr 24 '17 at 15:36
1

On Windows, unstripped executables may have a IMAGE_DIRECTORY_ENTRY_DEBUG directory. You can learn more about the PE format here.

Sadly this directory only contains information about where the corresponding metadata (.pdb file) is. A pdb may be generated when compiling along with the executable / library.

A pdb file is composed from different Streams. You are most propably interessted in the Global Symbol Stream.

I would suggest trying any .pdb parser (I don't think there is a complete implementation out there) to parse it. (Be sure to translate the addresses via OMAP stream).

  • Question (and excuse my lack of Windows knowledge) - I compiled a test program through MinGW's GCC, and objdump/nm were able to list all the symbols even though I haven't exported any. There was no pdb file either. Is this something specific to MinGW? – Zatherz Apr 24 '17 at 19:42
  • 1
    @Zatherz Only Microsoft toolchain produces PDB files. MinGW uses old style COFF symbols (see IMAGE_FILE_HEADER.PointerToSymbolTable in winnt.h). – Igor Skochinsky Apr 24 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.