While tracking down mysterious binary bloat, I found a bunch of new .rdata in my DLL. They are all strings that look like symbols of code, but my binary has RTTI turned off.
It took a bit of digging:
- Use the RVA from sizebench
- Use
link -dump -disasm -all -bytes thedll.dll > myfile.asm
- Search for the RVA in the asm file to get a symbolic name
- Search for the symbol in the asm file to find references
So two features in one:
Show the RVA symbolic name if it exists
In the view for the item, show both the gross-name and the decoded name if possible.
Provide a clickable link of functions that reference the symbol
This might be very costly to produce, but it would have made my life very easy. If the RVA is referenced in code, provide a link to the function disassembly that uses it. Bonus points for scrolling the listing and highlighting HERE IT IS for easy finding.
While tracking down mysterious binary bloat, I found a bunch of new
.rdatain my DLL. They are all strings that look like symbols of code, but my binary has RTTI turned off.It took a bit of digging:
link -dump -disasm -all -bytes thedll.dll > myfile.asmSo two features in one:
Show the RVA symbolic name if it exists
In the view for the item, show both the gross-name and the decoded name if possible.
Provide a clickable link of functions that reference the symbol
This might be very costly to produce, but it would have made my life very easy. If the RVA is referenced in code, provide a link to the function disassembly that uses it. Bonus points for scrolling the listing and highlighting HERE IT IS for easy finding.