Many of the compiler utilities shipped with Visual Studio and the DDK in recent times actually support symbols under the hood, but this support is not well documented.<\/p>\n
For example, “dumpbin.exe” (actually “link.exe \/dump”) supports this, and so does “dumpbin.exe \/disasm”.\u00c2\u00a0 All you need to do to activate this support is set the default symbol path with _NT_SYMBOL_PATH<\/a>.\u00c2\u00a0 Henceforth, you will be able to see symbol names for exported functions with dumpbin (if you have symbols, of course) – even functions that are exported by ordinal only.<\/p>\n Additionally, when combined with symbol support, you can use “dumpbin.exe \/disasm” as a quick-n-dirty x64\/IA-64 disassembler (a cheap replacement for IDA Pro Advanced, for instance).\u00c2\u00a0\u00c2\u00a0While certainly not as pleasant as a full project-based disassembler, it can get the job done in a pinch and it won’t cost you an arm and a leg either (not that I don’t love IDA, but they make it excessively difficult to get a copy of the 64-bit capable versions of their disassembler).\u00c2\u00a0\u00c2\u00a0 Skape and myself used this technique when performing research for our paper on x64’s “PatchGuard”.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Many of the compiler utilities shipped with Visual Studio and the DDK in recent times actually support symbols under the hood, but this support is not well documented. For example, “dumpbin.exe” (actually “link.exe \/dump”) supports this, and so does “dumpbin.exe \/disasm”.\u00c2\u00a0 All you need to do to activate this support is set the default symbol […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[2,8],"tags":[],"_links":{"self":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/29"}],"collection":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=29"}],"version-history":[{"count":1,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/29\/revisions"}],"predecessor-version":[{"id":654,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/29\/revisions\/654"}],"wp:attachment":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}