Search code examples
windowsreverse-engineeringwindbgportable-executable

How to dump all function names of an executable?


Is there a way (preferably command line) to dump all function names (not just exports/imports) of an executable?

The executable in question is a Microsoft EXE/DLL, so it should be possible to get the symbols from Microsoft Symbol Server.


Solution

  • Note that it is Microsoft's decision on how many symbols they want to publish. Just because there's a symbol server does not mean you get private symbols.

    You can do it in WinDbg:

    1. Open crash dump ... (not open executable)
    2. Select the DLL/Executable
    3. .symfix
    4. .reload
    5. x *!*

    And you can use cdb to do it from command line:

    cdb -z "c:\windows\system32\notepad.exe" -c ".symfix;.reload;x *!*;q"