Question

When I debug any program with debugger (for example OllyDbg), in disassembled assembly code, I can see function names, for example:

push 0
call msvcrt.exit

How does the debugger know the function names? Where do they come from? In machine code, it is represented as call address. So how debugger knows it?

Était-ce utile?

La solution

Compilers generate "symbols" files, providing to debuggers a way to show the name of a symbol that corresponds to a particular address or an offset. This is highly system-dependent: for example, VS toolchain on Windows places these symbols in separate .pdb files, while on some UNIX flavors these debug symbols are embedded into the executable. EDIT : According to the comments, OllyDbg pulls symbols from the Import Address Table embedded in executable files.

When symbols are embedded into the executable, compiler vendors provide a tool to remove these symbols. For example, GNU provides the strip utility to work with their toolchain.

Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top