ohio813 / pdbparse

Automatically exported from code.google.com/p/pdbparse
0 stars 0 forks source link

Weird symbols in some Windows 7 pdb's? #14

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?

Using the lookup example returns some weird symbols in certain Windows 7 pdb's. 
For example when checking the pdb for localspl.dll with PE GUID 4ce7b862bf000 I 
see symbols like:

Loading symbols for localspl.pdb...
Use lookup(addr) to resolve an address to its nearest symbol
>>> lookup(0xf498)
base: 0x0. limit: 0xbd8e8
idx: 1302
'localspl.pdb!??_C@_1BE@DENADGKH@?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAi?$AAm?$AAe?$
AA?$AA@'

What is the expected output? What do you see instead?

Most other symbols I've seen are like _GetFileVersionInfoW@16, therefore these 
symbols look out of place to me. Are these normal? 

What version of the product are you using? On what operating system?
SVN revision #95.

Original issue reported on code.google.com by tamas.k....@gmail.com on 30 Apr 2013 at 1:27

GoogleCodeExporter commented 9 years ago
This is normal. What you're seeing are C++ mangled names (described here: 
http://en.wikipedia.org/wiki/Visual_C%2B%2B_name_mangling ). Pdbparse contains 
a demangler (borrowed from the Wine project); have a look at 
pdbparse/undname.py (which depends on src/undname.c). These were added in 
revision #97, so you may have to update.

The specific example you gave resolves to `string', which unfortunately isn't 
very useful, but it's what the official undname.exe from Microsoft would give 
you.

Original comment by moo...@gmail.com on 30 Apr 2013 at 2:42

GoogleCodeExporter commented 9 years ago
Excellent, thanks!

Original comment by tamas.k....@gmail.com on 30 Apr 2013 at 2:52