2

I am using SymEnumSymbols to get all the matching symbols to a given mask, and push them into a vector using the CALLBACK function. The problem is, that the symbol name (which is inside the PSYMBOL_INFO structure) is only the name of the function, and not the whole signature.. For example, I have this function:

TestMe!GetImageProcAddress (struct HINSTANCE__ *hi, int num)

When I call SymEnumSymbols with the mask "TestMe!GetImageProcAddress", and prints the name of the matched symbol, I get:

printf("%s\n", pSymInfo->Name); // Prints: GetImageProcAddress

But I want it to print one of these:

TestMe!GetImageProcAddress (struct HINSTANCE__ *, int)
GetImageProcAddress (struct HINSTANCE__ *, int)

So my question - is there any way to get the full symbol signature (name of the function + type of parameters)? I was able to iterate through the parameters using SymSetContext, then SymEnumSymbols and filtering with the flag SYMFLAG_PARAMETER - but I don't know how to get the types of the parameters..

Thanks!

Guy
  • 137
  • 9

1 Answers1

2

After a long search - I have found a solution. After getting the index of the function, you need to enumerate it's parameters by setting the context to the specific function address using SymSetContext, then calling SymEnumSymbols (and set it to use the context):

SymEnumSymbols(GetCurrentProcess(), 0, NULL, ...)

Then, by using the flag SYMFLAG_PARAMETER you can select only the function parameters. Now, using the parameter TypeIndex, you can search for the parameter type by calling (a lot of times) to SymGetTypeInfo. It is not simple, and there are a lot of base cases...

A really good explanation can be found here: HOW TO USE DBGHELP TO ACCESS TYPE INFORMATION

And an example can be found here: TYPEINFODUMP

Good luck!

Guy
  • 137
  • 9