The power of dumpbin.exe with symbols

Many of the compiler utilities shipped with Visual Studio and the DDK in recent times actually support symbols under the hood, but this support is not well documented.

For example, “dumpbin.exe” (actually “link.exe /dump”) supports this, and so does “dumpbin.exe /disasm”.  All you need to do to activate this support is set the default symbol path with _NT_SYMBOL_PATH.  Henceforth, you will be able to see symbol names for exported functions with dumpbin (if you have symbols, of course) – even functions that are exported by ordinal only.

Additionally, when combined with symbol support, you can use “dumpbin.exe /disasm” as a quick-n-dirty x64/IA-64 disassembler (a cheap replacement for IDA Pro Advanced, for instance).  While certainly not as pleasant as a full project-based disassembler, it can get the job done in a pinch and it won’t cost you an arm and a leg either (not that I don’t love IDA, but they make it excessively difficult to get a copy of the 64-bit capable versions of their disassembler).   Skape and myself used this technique when performing research for our paper on x64’s “PatchGuard”.

Comments are closed.