C / C++ / MFC Discussion Boards

Re: display symbol at some address

«_Superman_»29-Jun-08 19:29

«_Superman_»

29-Jun-08 19:29

Will the PEDUMP tool do the job for you?

« Superman »

Re: display symbol at some address

George_George29-Jun-08 19:34

George_George

29-Jun-08 19:34

Hi Santosh,

In my understanding, PEDUMP tool dumps human readable information in a static way -- without running the binary. But my purpose is to dump information at runtime at some specific address. Without running, just do static analysis, you do you know what information (code/data/stack) will reside in some specific memory address, right?

Please feel free to correct me if I am wrong. Smile | :)

regards,
George

Re: display symbol at some address

«_Superman_»29-Jun-08 20:33

«_Superman_»

29-Jun-08 20:33

There is no specific address where each section resides.
You will need to understand the PE format.
It is a chain of data structures.
You will need to examine the PE Header and the PE optional header of the executable to get the starting relative virtual address of each section.

« Superman »

Re: display symbol at some address

George_George30-Jun-08 1:12

George_George

30-Jun-08 1:12

Thanks Santosh,

Sorry I do not agree with you. Suppose my application loads a DLL and I want to debug into the DLL, since DLL could be loaded into any address (possible reload), how could you just get the actual address using static analysis tool without running it? Smile | :)

Please feel free to correct me if I am wrong.

regards,
George

Re: display symbol at some address

«_Superman_»30-Jun-08 8:14

«_Superman_»

30-Jun-08 8:14

OK. Now I'm not sure if I understand your requirement. Smile | :)

« Superman »

Re: display symbol at some address

George_George30-Jun-08 16:00

George_George

30-Jun-08 16:00

I have a question for you, Santosh. Smile | :)

A DLL could be loaded at any arbitrary address, how could you use PEDUMP to analysis information at some address without actually run/load it. Let me know if I have not made myself understood.

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 20:21

Hamid_RT

30-Jun-08 20:21

Well if you read about PE is very helpful for you and if you like to see it I saw a very good article on the www.codeguru.com about it.

Re: display symbol at some address

George_George30-Jun-08 20:28

George_George

30-Jun-08 20:28

Thanks Hamid,

Could you post the link of the good article you referred please? CodeGuru is a big site. Smile | :)

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 20:37

Hamid_RT

30-Jun-08 20:37

you can search with PE,its more five page I think.

Re: display symbol at some address

George_George30-Jun-08 20:56

George_George

30-Jun-08 20:56

Can not find, any other keywords, Hamid? Here is what I found using "PE" as keyword.

http://search.internet.com/www.codeguru.com[^]

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 21:10

Hamid_RT

30-Jun-08 21:10

George_George wrote:
Can not find, any other keywords, Hamid? Here is what I found using "PE" as keyword.

<joke>

I think www.codeguru.com dont like you and it hides its info of you.

I could to find it for you Injective Code Inside an Import Table[^](I think my memory is good its more 5 pages Wink | ;)

)

But some other good articles for you dear George:
Windows PE 2.0 Tutorial[^]

Parsing the Portable Executable File Format[^]

Determining Whether a DLL or EXE Is a Managed Component[^]

Re: display symbol at some address

George_George30-Jun-08 21:30

George_George

30-Jun-08 21:30

Thanks Hamid!

But I do not think this one is related,

http://www.codeguru.com/csharp/.net/net_general/toolsand3rdparty/article.php/c15255/[^]

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 22:56

Hamid_RT

30-Jun-08 22:56

Dont you know C#? Smile | :)

Re: display symbol at some address

George_George30-Jun-08 23:09

George_George

30-Jun-08 23:09

Does it relates to my question, Hamid?

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 23:33

Hamid_RT

30-Jun-08 23:33

You said it was C# I asked do you know C#? Big Grin | :-D

Re: display symbol at some address

George_George30-Jun-08 23:43

George_George

30-Jun-08 23:43

Sure, Hamid!

Let us discuss the original question? Smile | :)

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 23:53

Hamid_RT

30-Jun-08 23:53

Did you see those articles? are they helpful?

Re: display symbol at some address

George_George1-Jul-08 0:03

George_George

1-Jul-08 0:03

Thanks Hamid,

I will read them today and response with you.

regards,
George

Re: display symbol at some address

George_George2-Jul-08 1:44

George_George

2-Jul-08 1:44

Yes, Hamid!

I have read the articles and tried the PEDUMP tool. I think it is used for analyze the physical binary file format, not to analyze the loaded in memory binary.

Any comments?

regards,
George

Re: display symbol at some address

Hamid_RT2-Jul-08 20:10

Hamid_RT

2-Jul-08 20:10

I think I found your answer but I dont remember your question (you have lot of questions) you want to read memory of a process(thread) with an address,right? well see ReadProcessMemory.

Re: display symbol at some address

George_George4-Jul-08 2:45

George_George

4-Jul-08 2:45

Sorry for my bad English, Hamid!

My question is, I can get the content of the memory, but I want to know what exactly resides in the memory -- i.e. does the memory content represents code or data? If I have symbol file, could I decode the memory content to human readable information? Any ideas?

regards,
George

Re: display symbol at some address

cmk30-Jun-08 5:25

cmk

30-Jun-08 5:25

To get the module the address is in use SymGetModuleInfo64().
This will resolve for all 'global' variables (functions and global data in exe's or dll's).

To get the raw (mangled) symbol name use SymGetSymFromAddr64().
To get the unmangled name use UnDecorateSymbolName() or SymUnDName64().

To check if the address is on the _current_ stack:

// Use NtCurrentTeb (undocumented) to get info for the current thread - including stack limits.
// http://www.bluebytesoftware.com/blog/PermaLink,guid,eb98baaf-0837-498d-a1e7-e4e16788f912.aspx
// http://www.bluebytesoftware.com/blog/PermaLink,guid,db077b7d-47ed-4f2a-8300-44203f514638.aspx
//
bool  IsOnCurrStack( cvoid *ADDR )
{
	NT_TIB *tib((NT_TIB*)::NtCurrentTeb());
	return( tib->StackLimit < ADDR && ADDR < tib->StackBase );
}

You should never see/care about an address on the stack of another thread unlesss you are a debugger.

...cmk

The idea that I can be presented with a problem, set out to logically solve it with the tools at hand, and wind up with a program that could not be legally used because someone else followed the same logical steps some years ago and filed for a patent on it is horrifying.
- John Carmack

Re: display symbol at some address

George_George30-Jun-08 15:52

George_George

30-Jun-08 15:52

Thanks cmk,

Great reply!

1.

I think "module" means EXE or DLL, it contains code (.text) and global data (.data), my question is whether a module's .text (or .data) segments are loaded as continuous address? I have this question is because when we use new/malloc to get memory from heap, they may not be continuous. I am not sure about .text (or .data)?

2.

Function "SymGetSymFromAddr64" is useful. But suppose the following scenario, I am using WinDbg or some other debugger to debug, and want to "decode" at some specific address to symbol names. How could I call such function? Any ideas?

regards,
George

Re: display symbol at some address

cmk30-Jun-08 17:07

cmk

30-Jun-08 17:07

1. There may be multiple code and data segments, so no, you can not assume the address' are continuous.

2. How you resolve the address is debugger specific. I would expect most to have built-in address-to-name resolution functionality.

Re: display symbol at some address

George_George30-Jun-08 17:32

George_George

30-Jun-08 17:32

Thanks cmk,

1.

I have debugged some programs, and using lm command in WinDbg to list all loaded DLLs by the debugged program. I saw all DLLs are loaded a continuous address. Why do you say "can not assume the address' are continuous" -- could you show a sample please?

2.

I think your built-in programatic solution is more comprehensive. Any ideas about how to do it in debugger? Smile | :)

regards,
George

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.