Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How does debugger know function names?

When I debug any program with debugger (for example OllyDbg), in disassembled assembly code, I can see function names, for example:

push 0
call msvcrt.exit

How does the debugger know the function names? Where do they come from? In machine code, it is represented as call address. So how debugger knows it?

like image 915
Smax Smaxović Avatar asked Oct 02 '22 23:10

Smax Smaxović


1 Answers

Compilers generate "symbols" files, providing to debuggers a way to show the name of a symbol that corresponds to a particular address or an offset. This is highly system-dependent: for example, VS toolchain on Windows places these symbols in separate .pdb files, while on some UNIX flavors these debug symbols are embedded into the executable. EDIT : According to the comments, OllyDbg pulls symbols from the Import Address Table embedded in executable files.

When symbols are embedded into the executable, compiler vendors provide a tool to remove these symbols. For example, GNU provides the strip utility to work with their toolchain.

like image 178
Sergey Kalinichenko Avatar answered Oct 13 '22 11:10

Sergey Kalinichenko