Dumpbin show function names

Question

Is there any way I can use dumpbin like objdump, where I can just look at the functions machine instructions that I implemented in my Source.c file, which I compiled to source.exe? If I use dumpbin \DISASM with the section .text it shows me a lot of machine instructions, but it's impossible to find the machine instructions I am looking for.

Answer 1

You could utilize debug symbols to search for the disassembled code of interest. Here's a TL;DR from dumpbin's docs:

1. dumpbin always searches for embedded symbols within the file:

The /DISASM option displays disassembly of code sections in the file. It uses debug symbols if they are present in the file.

2. dumpbin tries to load debug symbol information for the disassembled binary (works with PDB, no information on support for DWARF and other formats):

By default, DUMPBIN attempts to load PDB files for its target executables. DUMPBIN uses this information to match addresses to symbol names.

If your source.exe was compiled with MSVC, simply put .pdb file in the same directory and use:

dumpbin /DISASM source.exe

The output will have symbol names applied - example disassembly fragment:

??$?6U?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@PEBD@Z:
  0000000140011870: 48 89 54 24 10     mov         qword ptr [rsp+10h],rdx
  0000000140011875: 48 89 4C 24 08     mov         qword ptr [rsp+8],rcx
  000000014001187A: 55                 push        rbp
  000000014001187B: 57                 push        rdi
  000000014001187C: 48 81 EC 28 02 00  sub         rsp,228h
                    00
  0000000140011883: 48 8D 6C 24 20     lea         rbp,[rsp+20h]
  0000000140011888: 48 8D 7C 24 20     lea         rdi,[rsp+20h]
  000000014001188D: B9 52 00 00 00     mov         ecx,52h
  0000000140011892: B8 CC CC CC CC     mov         eax,0CCCCCCCCh
  0000000140011897: F3 AB              rep stos    dword ptr [rdi]
  0000000140011899: 48 8B 8C 24 48 02  mov         rcx,qword ptr [rsp+248h]
                    00 00
  00000001400118A1: 48 8B 05 58 B7 00  mov         rax,qword ptr [__security_cookie]
                    00
  00000001400118A8: 48 33 C5           xor         rax,rbp
  00000001400118AB: 48 89 85 F8 01 00  mov         qword ptr [rbp+1F8h],rax
                    00
  00000001400118B2: 48 8D 0D AA 17 01  lea         rcx,[140023063h]
                    00
  00000001400118B9: E8 11 FB FF FF     call        @ILT+970(__CheckForDebuggerJustMyCode)
  00000001400118BE: C7 45 04 00 00 00  mov         dword ptr [rbp+4],0
                    00
  00000001400118C5: 48 8B 8D 28 02 00  mov         rcx,qword ptr [rbp+228h]
                    00
  00000001400118CC: E8 79 F8 FF FF     call        @ILT+325(?length@?$_Narrow_char_traits@DH@std@@SA_KQEBD@Z)

...

If you find decorated names confusing, you can use undname to decipher decorated/mangled symbol names into their signatures:

undname <decorated name>