List all functions from an executable

delphi package - full disassembler

List all functions from an executable

Postby Keiner » Mon Nov 17, 2008 10:33 am

Hi,

is it possible to list all functions of an executable? Can ParseFunction return a pointer to the next function?

take care, keiner
Keiner
 
Posts: 2
Joined: Mon Nov 17, 2008 10:28 am

Postby Nico Bendlin » Mon Nov 17, 2008 10:40 am

Compilers are free to overlap any code sequences. So there might be no "next" function. Another problem are function "tails" (code fragments of a function outside of the function’s main "body" - e.g. MSVC’s PGO).
Nico Bendlin
 
Posts: 46
Joined: Fri Apr 28, 2006 1:17 pm

Postby Keiner » Mon Nov 17, 2008 11:05 am

How does IDA/OllyDBG handle those problems? I mean the results aren't 100% correct but at least its a point where i can start.
Keiner
 
Posts: 2
Joined: Mon Nov 17, 2008 10:28 am

Postby Nico Bendlin » Mon Nov 17, 2008 2:16 pm

Well, for ParseFunction one needs the entry point of the function (your task). This implies, that it is intended to analyze one function - not the whole program control flow (a job for IDA). The analyzed function could be followed by anything (e.g. hundreds and thousands of data bytes).

topic: Back to your initial question: TFunctionInfo.CodeLen
Nico Bendlin
 
Posts: 46
Joined: Fri Apr 28, 2006 1:17 pm

Postby madshi » Mon Dec 01, 2008 7:57 pm

Nico is right, of course.

One option would be to disassemble the EXE's entry point function plus every exported function. Then for every disassembled function you can enumerate the call instructions. You can then disassemble the call targets. This will again give you a new list of call instructions. You can do this recursively. That will probably not result in a full disassembly of the whole EXE, but it might cover the majority of functions. Of course there are problems: E.g. some calls are hard to trace. And if a thread is created, you will probably miss the thread function and all functions it calls inside etc...
madshi
Site Admin
 
Posts: 9265
Joined: Sun Mar 21, 2004 5:25 pm


Return to madDisAsm

Who is online

Users browsing this forum: No registered users and 1 guest

cron