How does the debugger know function names?

When I debug any program with a debugger (for example, OllyDbg), in disassembled assembler I can see the names of functions, for example:

push 0 call msvcrt.exit 

How does the debugger know function names? Where are they from? In machine code, it is represented as a call address . So how does the debugger know this?

+4
source share
1 answer

Compilers generate “character” files, providing debuggers with a way to display the character name corresponding to a specific address or offset. This is highly system dependent: for example, the VS toolchain on Windows places these symbols in separate .pdb files, while on some UNIX variants these debug symbols are embedded in the executable. EDIT:. According to the comments, OllyDbg pulls characters from the import address table embedded in the executables.

When characters are embedded in an executable, compiler vendors provide a tool to remove these characters. For example, GNU provides the strip utility to work with their toolchain.

+4
source

Source: https://habr.com/ru/post/1502295/


All Articles