I am using SymEnumSymbols
to get all the matching symbols to a given mask, and push them into a vector using the CALLBACK function. The problem is, that the symbol name (which is inside the PSYMBOL_INFO
structure) is only the name of the function, and not the whole signature.. For example, I have this function:
TestMe!GetImageProcAddress (struct HINSTANCE__ *hi, int num)
When I call SymEnumSymbols
with the mask "TestMe!GetImageProcAddress"
, and prints the name of the matched symbol, I get:
printf("%s\n", pSymInfo->Name); // Prints: GetImageProcAddress
But I want it to print one of these:
TestMe!GetImageProcAddress (struct HINSTANCE__ *, int)
GetImageProcAddress (struct HINSTANCE__ *, int)
So my question - is there any way to get the full symbol signature (name of the function + type of parameters)? I was able to iterate through the parameters using SymSetContext
, then SymEnumSymbols
and filtering with the flag SYMFLAG_PARAMETER
- but I don't know how to get the types of the parameters..
Thanks!
After a long search - I have found a solution.
After getting the index of the function, you need to enumerate it's parameters by setting the context to the specific function address using SymSetContext
, then calling SymEnumSymbols
(and set it to use the context):
SymEnumSymbols(GetCurrentProcess(), 0, NULL, ...)
Then, by using the flag SYMFLAG_PARAMETER
you can select only the function parameters. Now, using the parameter TypeIndex
, you can search for the parameter type by calling (a lot of times) to SymGetTypeInfo
. It is not simple, and there are a lot of base cases...
A really good explanation can be found here: HOW TO USE DBGHELP TO ACCESS TYPE INFORMATION
And an example can be found here: TYPEINFODUMP
Good luck!