TheSwamp
Code Red => .NET => Topic started by: Kerry on July 27, 2010, 05:06:29 PM
-
Some of the dumpBin result files used for determining mangled names for p'invoke.
AC2011
-
Some of the dumpBin result files used for determining mangled names for p'invoke.
AC2010
-
Some of the dumpBin result files used for determining mangled names for p'invoke.
AC2008
-
Attached is a little utility to undecorate the names in the file. Usage is from the cmd.exe prompt.
edit 1: attached undecorBin.zip (cmd executable).
edit 2: Cleaned up source code, fixed bug that caused exception with some input files, made instructions clearer.
undecor inputfile outputfile
outputfile will have the extention .und
So undecor dumpbin_AC2008.txt dumpbin_AC2008 will create the file dumpbin_AC2008.und
Input file with mangled names
17 10 002CEFA0 ??0AcPlPlotConfigInfo@@QAE@ABV0@@Z
18 11 002CEF10 ??0AcPlPlotConfigInfo@@QAE@PB_W0W4DeviceType@@@Z
19 12 001D0BE0 ??0AcPlPlotConfigInfo@@QAE@XZ
20 13 001D4880 ??0AcPlPlotErrorHandlerLock@@QAE@PAVAcPlPlotErrorHandler@@PB_W@Z
21 14 002CF460 ??0AcPlPlotErrorHandlerLock@@QAE@XZ
Output file with unmangled names.
public: __thiscall AcPlPlotConfigInfo::AcPlPlotConfigInfo(class AcPlPlotConfigInfo const &)
public: __thiscall AcPlPlotConfigInfo::AcPlPlotConfigInfo(wchar_t const *,wchar_t const *,enum DeviceType)
public: __thiscall AcPlPlotConfigInfo::AcPlPlotConfigInfo(void)
public: __thiscall AcPlPlotErrorHandlerLock::AcPlPlotErrorHandlerLock(class AcPlPlotErrorHandler *,wchar_t const *)
public: __thiscall AcPlPlotErrorHandlerLock::AcPlPlotErrorHandlerLock(void)
Here's a link to a discussion that goes into more detail.
http://groups.google.com/group/microsoft.public.vc.utilities/browse_thread/thread/ea50c955b55bde75/c03a77b122ed36be?hl=en&ie=UTF-8&q=unmangle+%22paul+kohut%22#c03a77b122ed36be
note, attached code has the bug fix mentioned in the link.
-
Thanks Paul, I'll have a look as soon as I get a chance.
-
Good one Paul.
-
Thanks guys. I updated the code, cause the original is atrocious. Made the instructions a bit clearer. Also, fixed a bug that would occurred when an input file was created with dumpbin's /all switch (don't recommend using that switch anyway, but its fixed if you do).
Here's the main work section of the new code. Nothing fancy.
try
{
ifstream inFile;
inFile.open(argv[1], ios::in);
if(!inFile.good()) {
cerr << argv[1] << " could not be opened for read." << endl;
exit(1);
}
string sOutFile(argv[2]);
sOutFile += ".und";
ofstream outFile;
outFile.open(sOutFile.c_str(), ios::out | ios::trunc);
if(!outFile.good()) {
cerr << sOutFile << " could not be created." << endl;
exit(1);
}
string sLine;
string sResult(1024, '\0');
while(getline(inFile, sLine, '\n'))
{
size_t nStart = sLine.find_first_of('?');
if(nStart != string::npos) {
size_t nEnd = sLine.find_first_of(' ', nStart);
if(nEnd != string::npos) {
sLine = sLine.substr(nStart, nEnd - nStart);
} else {
sLine = sLine.substr(nStart);
}
DWORD dwErr = UnDecorateSymbolName(sLine.c_str(), &sResult[0],1024, 0);
if(dwErr) {
outFile << sResult.c_str() << endl;
} else {
dwErr = GetLastError();
FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dwErr,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
&sResult[0], 1024, NULL);
cerr << sResult.c_str();
}
}
}
}
-
DLL Export Viewer
This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL (and exe, COM type libraries) files
http://www.nirsoft.net/utils/dllexp.zip
http://www.nirsoft.net/utils/dllexp-x64.zip
-
This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL (and exe, COM type libraries) files
Way back in the early days of CADLock, I was exploring how to rebuild symbol data that could be loaded into WinDbg and Softice, and had limited success. I don't remember the details, but I think it was done just with the tools MS supplied. And, IIRC, this allowed setting breakpoints on function names, jumping straight to disassembled code in the debugger, and seeing function names in the debugger for code we didn't have source to. It didn't provide all the debug details like you get when compiling a program, but what little could be extracted was better than nothing.
I quit doing any work with/for CADLock in '99, so details are fuzzy at best without looking at old journals and email. Maybe Owen can shed some light on the details, or tell if he ever got a good method to recover useful symbol data.
ps, DllExp provides a nice view into the data. Wish we had it back when.
-
I just did for 2012 and 13, attached
-
I just did for 2012 and 13, attached
For 2013 some have moved to accore.dll
Attached
-
I just did for 2012 and 13, attached
http://www.theswamp.org/index.php?topic=41527.msg466302#msg466302
-
Thanks! you saved me the trouble 8-)