Method DumpSymbol

User-Bridge/API/SymParser.cpp:201–256

BOOL SymParser::DumpSymbol(LPCWSTR SymbolName, OUT SYM_INFO& SymInfo) {
    SymInfo = {};

    // Obtaining root symbol:
    const ULONG SymNameLength = 128;
    const ULONG SymInfoSize = sizeof(SYMBOL_INFO) + SymNameLength * sizeof(WCHAR);
    std::vector<BYTE> RootSymbolInfoBuffer(SymInfoSize);
    auto RootSymbolInfo = reinterpret_cast<PSYMBOL_INFO>(&RootSymbolInfoBuffer[0]);
    RootSymbolInfo->SizeOfStruct = SymInfoSize;
    BOOL Status = SymGetTypeFromName(hProcess, ModuleBase, SymbolName, RootSymbolInfo);
    if (!Status) return FALSE;

    ULONG RootIndex = RootSymbolInfo->Index;

    SymInfo.Name = GetSymName(RootIndex);
    SymInfo.Size = GetSymSize(RootIndex);
    SymInfo.Offset = GetSymOffset(RootIndex, &Status);
    if (!Status) SymInfo.Offset = GetSymAddressOffset(RootIndex);

    // Obtaining root symbol children count:
    ULONG ChildrenCount = 0;
    Status = SymGetTypeInfo(hProcess, ModuleBase, RootIndex, TI_GET_CHILDRENCOUNT, &ChildrenCount);
    if (!Status) return FALSE;

    SymInfo.Name = SymbolName;
    SymGetTypeInfo(hProcess, ModuleBase, RootIndex, TI_GET_LENGTH, &SymInfo.Size);

    if (ChildrenCount) {
        // Obtaining children indices:
        std::vector<BYTE> FindChildrenParamsBuffer(sizeof(TI_FINDCHILDREN_PARAMS) + ChildrenCount * sizeof(ULONG));
        auto Children = reinterpret_cast<TI_FINDCHILDREN_PARAMS*>(&FindChildrenParamsBuffer[0]);
        Children->Count = ChildrenCount;
        Status = SymGetTypeInfo(hProcess, ModuleBase, RootIndex, TI_FINDCHILDREN, Children);
        if (!Status) return FALSE;

        for (unsigned int i = 0; i < ChildrenCount; i++) {
            SYM_CHILD_ENTRY Entry = {};
            ULONG ChildIndex = Children->ChildId[i];
            ULONG TypeId = GetSymTypeId(ChildIndex);
            Entry.Name = GetSymName(ChildIndex);
            Entry.Size = GetSymSize(TypeId);
            Entry.Offset = GetSymOffset(ChildIndex);
            Entry.BitPosition = GetSymBitPosition(ChildIndex, &Entry.IsBitField);
            UINT64 BaseTypeSize = 0;
            Entry.TypeName = GetSymTypeName(TypeId, &BaseTypeSize);
            Entry.ElementsCount = BaseTypeSize != 0 ? Entry.Size / BaseTypeSize : 1;

            if (Entry.Name.empty()) Entry.Name = L"UNKNOWN_NAME";
            if (Entry.TypeName.empty()) Entry.TypeName = L"UNKNOWN_TYPE";

            SymInfo.Entries.emplace_back(Entry);
        }
    }

    return TRUE;
}