Description Kirk Beitz 2010-08-11 00:22:55 EDT

Created attachment 176293 [details]
patch to ignore "NO SYMBOL" coff-symbols and override getSymbolAtAddress() not to perform size check

context: class PEFileExecutableSymbolReader currently relies on class BaseExecutableSymbolReader for its implementation of getSymbolAtAddress().

however, since PEFileExecutableSymbolReader construtor (in private member function recordSegments() ) indiscriminately collects all symbols found in the Coff symbol-table in the Collection of symbols and sets the size of every segment to 1, then the member BaseExecutableSymbolReader#getSymbolAtAddress() fails when attempting to find addresses in functions (whereas the other executable symbol readers that maintain a proper size succeed), because getSymbolAtAddress() performs a size check.

the attachment PEFileExecutableSymbolReader.java.1.4.patch attempts to solve this problem in two ways:

(1) do not add symbols to the Collection<symbol> symbols that have a Coff type of T_NULL which translates to "NO SYMBOL"
(2) create an @override PEFileExecutableSymbolReader#getSymbolAtAddress that does not perform a size check.

caveat: the solution is still not perfect, just a lot better (at least for my testing purposes); what is not perfect is (a) the size of each symbol is still listed as 1 (as before); not enough time/resource to properly figure out the size of each symbol within PEFileExecutableSymbolicsReader, nor from the existing Coff.java code; and (b) it doesn't account for multiple symbols found at the same exact address, though it will at least act the same in this case as it has in the past, returning the symbol at the point found in the Collection<symbol>#binary_search call.