How do correlate symbol information from PDB with PE contents?

0

I've been trying to get a better understanding of where my C++ source code ends up in a PE format and how to find specific points in my source code in the PE. For example, I have a simple program which I've compiled with /Od and /ZI flags.

There's one source file with the following functions: main, PrintVector, AddOneToEach.

When I open main.exe in a hex editor, I can correlate addresses and values in the PE image with certain values from dumpbin ./main.exe /headers using PE structure documentation as a reference. For example:

FILE HEADER VALUES
             14C machine (x86)
               7 number of sections
        5E48E9D4 time date stamp Sat Feb 15 23:05:56 2020
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             102 characteristics
                   Executable
                   32 bit word machine

OPTIONAL HEADER VALUES
             10B magic # (PE32)
           14.16 linker version
           9DA00 size of code
           25400 size of initialized data
               0 size of uninitialized data
           4BD1C entry point (0044BD1C) @ILT+19735(_mainCRTStartup)

I know that at address 0x3c, I should find a 4-byte long field that contains the address of the start of the PE Header. I find in little endian format 0x00010000 which translates to 0x00000100. At address 0x00000100, I find the expected little endian value of 0x50450000 per the PE format documentation.

When examining the associated PDB file, I look up the symbol PrintVector via powershell & $dbh ./main.pdb n PrintVector where $dbh = C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbh.exe. The ouput is:

   name : PrintVector
   addr :  1059090
   size : 86
  flags : 0
   type : 2
modbase :  1000000
  value :        0
    reg : 0
  scope : SymTagExe (1)
    tag : SymTagFunction (5)
  index : 1

Given the address value of 0x01059090, my expectation is to be able to find the start of the function PrintVector at address 0x01059090 in main.exe. However, the address range main.exe ends at 0x000cf15f0, which tells my there's something wrong with my understanding of Virtual Addressing and the PE format. My expectation is that I should be able to find the entry point into the function PrintVector somewhere in main.exe based on the address pulled via Dumpbin using DBH on the PDB file. Where is my understanding breaking down?

c++
windows
linker
symbols
virtual-address-space
asked on Stack Overflow Feb 16, 2020 by Joe

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0