Calling a non-exported function in a DLL

Question

I have a program which loads DLLs and I need to call one of the non-exported functions it contains. Is there any way I can do this, via searching in a debugger or otherwise? Before anyone asks, yes I have the prototypes and stuff for the functions.

Answer 1

Even if you can find the function address, it's not in general safe to call a function created by a compiler that thought it was making a "private" internal-use-only function.

Modern compilers with link-time-optimization enabled may make a specialized version of a function that only does what the specific callers need it to do.

Don't assume that a block of machine code that looks like the function you want actually follows the standard ABI and implements everything the source code says.

In gcc's case, it does use special names for specialized versions of a function that aren't inlined but take advantage of a special case (like constant propagation) from multiple callers.

e.g. in this objdump -drwC output (where -C is demangle):

42944c: e8 cf 13 0e 00 call 50a820 429451: 48 8b 7b 48 mov rdi,QWORD PTR [rbx+0x48] 429455: 48 89 ee mov rsi,rbp 429458: e8 b3 10 0e 00 call 50a510

gcc emits code that calls two different clones of the same function, specialized for two different compile-time-constants. (This is from http://endless-sky.github.io/, which desperately needs LTO because even trivial accessor functions for its XY position class are in Point.cpp, not Point.h, so they can only be inlined by LTO.)

LTO can even make .lto_priv static versions of data: like

mov    rcx,QWORD PTR [rip+0x412ff7]        # 83dbe0 <_ZN12_GLOBAL__N_116playerGovernmentE.lto_priv.898>

So even if you find a function that looks like what you want, calling it from a new place might violate the assumptions that Link-Time-Optimization took advantage of.