TheSwamp

Code Red => .NET => Topic started by: Kerry on July 27, 2010, 05:06:29 PM

Title: DumpBin Results for PINVOKE
Post by: Kerry on July 27, 2010, 05:06:29 PM
Some of the dumpBin result files used for determining mangled names for p'invoke.

AC2011

Title: Re: DumpBin Results
Post by: Kerry on July 27, 2010, 05:07:30 PM

Some of the dumpBin result files used for determining mangled names for p'invoke.

AC2010
Title: Re: DumpBin Results
Post by: Kerry on July 27, 2010, 05:08:37 PM

Some of the dumpBin result files used for determining mangled names for p'invoke.

AC2008
Title: Re: DumpBin Results
Post by: pkohut on July 27, 2010, 08:07:38 PM
Attached is a little utility to undecorate the names in the file. Usage is from the cmd.exe prompt.
edit 1: attached undecorBin.zip (cmd executable).
edit 2: Cleaned up source code, fixed bug that caused exception with some input files, made instructions clearer.

Code: [Select]
undecor inputfile outputfileoutputfile will have the extention .und
So undecor dumpbin_AC2008.txt dumpbin_AC2008 will create the file dumpbin_AC2008.und

Input file with mangled names
Code: [Select]
        17   10 002CEFA0 ??0AcPlPlotConfigInfo@@QAE@ABV0@@Z
         18   11 002CEF10 ??0AcPlPlotConfigInfo@@QAE@PB_W0W4DeviceType@@@Z
         19   12 001D0BE0 ??0AcPlPlotConfigInfo@@QAE@XZ
         20   13 001D4880 ??0AcPlPlotErrorHandlerLock@@QAE@PAVAcPlPlotErrorHandler@@PB_W@Z
         21   14 002CF460 ??0AcPlPlotErrorHandlerLock@@QAE@XZ

Output file with unmangled names.
Code: [Select]
public: __thiscall AcPlPlotConfigInfo::AcPlPlotConfigInfo(class AcPlPlotConfigInfo const &)
public: __thiscall AcPlPlotConfigInfo::AcPlPlotConfigInfo(wchar_t const *,wchar_t const *,enum DeviceType)
public: __thiscall AcPlPlotConfigInfo::AcPlPlotConfigInfo(void)
public: __thiscall AcPlPlotErrorHandlerLock::AcPlPlotErrorHandlerLock(class AcPlPlotErrorHandler *,wchar_t const *)
public: __thiscall AcPlPlotErrorHandlerLock::AcPlPlotErrorHandlerLock(void)

Here's a link to a discussion that goes into more detail.
http://groups.google.com/group/microsoft.public.vc.utilities/browse_thread/thread/ea50c955b55bde75/c03a77b122ed36be?hl=en&ie=UTF-8&q=unmangle+%22paul+kohut%22#c03a77b122ed36be
note, attached code has the bug fix mentioned in the link.
Title: Re: DumpBin Results
Post by: Kerry on July 27, 2010, 11:46:10 PM

Thanks Paul, I'll have a look as soon as I get a chance.
Title: Re: DumpBin Results
Post by: Glenn R on July 28, 2010, 04:58:46 AM
Good one Paul.
Title: Re: DumpBin Results
Post by: pkohut on July 28, 2010, 09:36:11 AM
Thanks guys.  I updated the code, cause the original is atrocious. Made the instructions a bit clearer. Also, fixed a bug that would occurred when an input file was created with dumpbin's /all switch (don't recommend using that switch anyway, but its fixed if you do).

Here's the main work section of the new code. Nothing fancy.
Code: [Select]
    try
    {
        ifstream inFile;
        inFile.open(argv[1], ios::in);
        if(!inFile.good()) {
            cerr << argv[1] << " could not be opened for read." << endl;
            exit(1);
        }

        string sOutFile(argv[2]);
        sOutFile += ".und";
        ofstream outFile;
        outFile.open(sOutFile.c_str(), ios::out | ios::trunc);
        if(!outFile.good()) {
            cerr << sOutFile << " could not be created." << endl;
            exit(1);
        }

        string sLine;
        string sResult(1024, '\0');

        while(getline(inFile, sLine, '\n'))
        {
            size_t nStart = sLine.find_first_of('?');
            if(nStart != string::npos) {
                size_t nEnd = sLine.find_first_of(' ', nStart);
                if(nEnd != string::npos) {
                    sLine = sLine.substr(nStart, nEnd - nStart);
                } else {
                    sLine = sLine.substr(nStart);
                }

                DWORD dwErr = UnDecorateSymbolName(sLine.c_str(), &sResult[0],1024, 0);
                if(dwErr) {
                    outFile << sResult.c_str() << endl;
                } else {
                    dwErr = GetLastError();
                    FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dwErr,
                        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
                        &sResult[0], 1024, NULL);
                    cerr << sResult.c_str();
                }
            }
        }
    }
Title: Re: DumpBin Results
Post by: jgr on July 28, 2010, 07:33:01 PM
DLL Export Viewer
This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL (and exe, COM type libraries) files

http://www.nirsoft.net/utils/dllexp.zip
http://www.nirsoft.net/utils/dllexp-x64.zip
Title: Re: DumpBin Results
Post by: pkohut on July 28, 2010, 10:34:11 PM
This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL (and exe, COM type libraries) files

Way back in the early days of CADLock, I was exploring how to rebuild symbol data that could be loaded into WinDbg and Softice, and had limited success.  I don't remember the details, but I think it was done just with the tools MS supplied. And, IIRC, this allowed setting breakpoints on function names, jumping straight to disassembled code in the debugger, and seeing function names in the debugger for code we didn't have source to. It didn't provide all the debug details like you get when compiling a program, but what little could be extracted was better than nothing.

I quit doing any work with/for CADLock in '99, so details are fuzzy at best without looking at old journals and email. Maybe Owen can shed some light on the details, or tell if he ever got a good method to recover useful symbol data.

ps, DllExp provides a nice view into the data. Wish we had it back when.
Title: Re: DumpBin Results for PINVOKE
Post by: jmaeding on December 13, 2012, 01:33:52 PM
I just did for 2012 and 13, attached
Title: Re: DumpBin Results for PINVOKE
Post by: Jeff H on December 13, 2012, 02:51:49 PM
I just did for 2012 and 13, attached

For 2013 some have moved to accore.dll
Attached
Title: Re: DumpBin Results for PINVOKE
Post by: Kerry on December 13, 2012, 05:53:43 PM
I just did for 2012 and 13, attached

http://www.theswamp.org/index.php?topic=41527.msg466302#msg466302
Title: Re: DumpBin Results for PINVOKE
Post by: It's Alive! on January 16, 2013, 07:44:20 AM
Thanks! you saved me the trouble  8-)