Getting function names from ordinals in a dll

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • vekipeki
    Recognized Expert New Member
    • Nov 2007
    • 229

    Getting function names from ordinals in a dll

    Hi, first of all sorry if this isn't exactly C++ related, but didn't know where it would be more appropriate.

    I am trying to get actual function names from their ordinal numbers from a COM dll. I tried using dumpbin.exe but it only returns [NONAME] for each ordinal (except the first few):

    Code:
        ordinal hint RVA      name
    
             21    0 00002439 DllCanUnloadNow
             25    1 00007F41 DllGetClassObject
            116    2 0000539C DllMain
            138    3 00008633 DllRegisterServer
            176    4 00008640 DllUnregisterServer
              1      0009152E [NONAME]
              2      00154CA7 [NONAME]
              3      00154C0B [NONAME]
              4      000140C9 [NONAME]
            ...
    The directory containing the .dll file doesn't contain any other files (*.tlb, *.lib).

    I also tried using OLE/COM object viewer, but didn't find the relation between them.

    Could someone tell me how to get a list of these? Or at least the name of a specific ordinal using registry or something?
  • vekipeki
    Recognized Expert New Member
    • Nov 2007
    • 229

    #2
    Additional info:

    I cannot find the .def file for the COM dll, so I cannot use it to get the name. I am not interested in instantiating the COM class, I only want to know what function is related to a specified ordinal.

    My original problem is that I have found an exception using WinDbg, which happens in ChartFXClientSe rverCore!Ordina l5507(+0x97b7), so I would like to see the specific function to try to isolate the problem.

    Comment

    • weaknessforcats
      Recognized Expert Expert
      • Mar 2007
      • 9214

      #3
      Use the Visual Studio.NET debugger to display the call stack. One click will put you at the calling function.

      Comment

      • vekipeki
        Recognized Expert New Member
        • Nov 2007
        • 229

        #4
        But it doesn't display the call stack for the unmanaged side (COM). The problem is that exception happens in the message loop, so the method at breakpoint is Application.Run ():

        Code:
        -- Message: Attempted to read or write protected memory.
           This is often an indication that other memory is corrupt.
        -- Stack trace:
           at System.Windows.Forms.UnsafeNativeMethods
              .DispatchMessageW(MSG& msg)
           at System.Windows.Forms.Application.ComponentManager
              .System.Windows.Forms.UnsafeNativeMethods
              .IMsoComponentManager.FPushMessageLoop
              (Int32 dwComponentID, Int32 reason, Int32 pvLoopData)
           at System.Windows.Forms.Application.ThreadContext
              .RunMessageLoopInner(Int32 reason, ApplicationContext context)
           at System.Windows.Forms.Application.ThreadContext
              .RunMessageLoop(Int32 reason, ApplicationContext context)
           at System.Windows.Forms.Application.Run(ApplicationContext context)
           at MyApp.Program.Main()
        If I try to catch it, RunMessageLoopI nner disposes my form before it throws the actual exception.

        Using WinDbg, I managed to get this:

        Code:
        (ca84.c98c): Access violation - code c0000005 (first chance)
        First chance exceptions are reported
        before any exception handling.
        This exception may be expected and handled.
        eax=00000000 ebx=06e67c38 ecx=06e67c38
         edx=000018c6 esi=06e7df30 edi=317a9e80
        eip=31666110 esp=0015e040 ebp=0015e08c iopl=0 nv up ei pl zr na pe nc
        cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
        
        ChartFX_ClientServer_Core!Ordinal5507+0x97b7:
        31666110 8a404d mov  al,byte ptr [eax+4Dh] ds:0023:0000004d=??

        Comment

        Working...