What there is though, is an aisle full of ingredients going by the name of DbgEng.dll. This fellow forms part of the debugging tools triumverate with its more illustrious counterpart dbghelp.dll and the mysterious symsrv.dll. DbgEng contains the interfaces which make up WinDbg's core functionality, a portion of such is disassembling. So, being the sort of chef who would appear on a Gordon Ramsay show in quite short order, I rustled up a quick messily coded bun.
It's not IDA or Hiew, it's not meant to be. But for an 'objdump -d' like, quick and dirty tool that handles the 3 most common Windows architectures (as well as ARM and Alpha!) and doesn't require a toolchain to be installed, it's perfectly acceptable for my uses. It may be for others too, so have at it if you should so desire.
Download it here
AMD64 output with symbols.
ARM output from files compiled by eMbedded VC.
The code was to be part of a larger project which never was and so, is in a terrible state mixed with this library and that. In scant consolation, below are the basic steps to how it works, and how you can do it yourself if you're suitably deranged. The help for these interfaces and functions is on MSDN (obviously) and also the debugger.chm help file that comes with the Debugging Tools For Windows package which also houses the up to date headers, libs, and other helpful little programs.
[rollup='Pseudocode steps']
// setup
DebugCreate(IDebugClient)
IDebugClient->QueryInterface(IDebugControl)
IDebugControl->SetOutputCallbacks()
IDebugClient->SetEventCallbacks()
// launch the helper process
IDebugClient->CreateProcessAndAttach(0, "host.exe", DEBUG_ONLY_THIS_PROCESS, 0, 0)
IDebugControl->WaitForEvent()
// set the default symbol options
IDebugClient->QueryInterface(IDebugSymbols3)
IDebugSymbols3->SetSymbolOptions(SymbolOptions);
// unload all the existing symbols
IDebugSymbols3->GetNumberModules()
foreach(module)
{
IDebugSymbols3->GetModuleParameters(ModParams)
IDebugSymbols3->GetModuleNames(ModParams.Base, moduleName)
IDebugSymbols3->Reload("/u " + moduleName")
}
// map the file to be disassembled into the relevant processes
MappedFile = MapAsDataFileInCurrentProcess("C:\Mod\\to\\disasm.dll")
IDebugControl->SetEffectiveProcessorType(MappedFile->NtHeaders.FileHeader.Machine)
MappedAddress = MapDataFileAsExeIntoHostExe(out MappedSize) // 1
// load it as a virtual module in the target process
IDebugSymbols3->Reload("/s /f /w =,0x)
// check that it loaded where we want it
IDebugSymbols3->GetModuleByModuleName(, &realModuleBase)
// if not, load a second virtual module at this address
// this is so any absolute addressed symbols can be resolved
if(realModuleBase != MappedFile->NtHeaders.OptionalHeader.ImageBase)
{
IDebugSymbols3->Reload("/s /f /w =,0x)
}
// get setup for the disassembly
IDebugControl->SetAssemblyOptions(DEBUG_ASMOPT_*)
From there you can enumerate the symbols using:
IDebugSymbols3::GetSymbolEntriesByName("!*", &numSymbols)
for(numSymbols)
{
IDebugSymbols3::GetSymbolEntryInformation(symId, &entry);
IDebugSymbols3::GetSymbolEntryString(symId)
}
or get the sections via investigating the Nt and section headers of the mapped file
and then output the disassembly via:
DEBUG_SYMBOL_ENTRY symEntry = /**/;
ULONG64 endOfInstruction = symEntry.Offset;
ULONG64 endOfSymbol = symEntry.Offset + symEntry.Size; // 2
while(endOfInstruction < endOfSymbol)
{
IDebugControl::OutputDisassembly(DEBUG_OUTCTL_THIS_CLIENT, endOfInstruction, DEBUG_DISASM_MATCHING_SYMBOLS, &endOfInstruction);
}
--- end
1. MapDataFileAsExeIntoHostExe() should map the file and its sections as if it were to be executed, e.g. with the section alignment specified in the NtHeader. The handle to the host.exe process is given to you by DbgEng through the IDebugEventCallbacks::CreateProcess callback. Use MapViewOfFileEx or equivalent to attempt to map the file at it's preferred base address (MappedFile->NtHeaders.OptionalHeader.ImageBase)
2. Some symbols don't have a size entry. In this case, DisAsm sorts all symbols by offset and takes the start of the next symbol as the end of the current one.
[/rollup]
[1] - The lesser known tool is certutil.exe, the command line to hash files is
certutil -hashfile
Hash name can be SHA1, SHA256, SHA384, SHA512, MD2, MD4, MD5, must be uppercase
