Q177429: INFO: Examples of DUMPBIN Output
Article: Q177429
Product(s): Microsoft C Compiler
Version(s): winnt:2.0,2.1,2.2,4.0,4.1,4.2,4.2b,5.0,5.0sp1,5.0sp2,6.0
Operating System(s):
Keyword(s): kbVC200 kbVC210 kbVC220 kbVC400 kbVC410 kbVC420 kbVC500 kbVC600
Last Modified: 07-MAY-2001
-------------------------------------------------------------------------------
The information in this article applies to:
- Microsoft Visual C++, versions 2.0, 2.1, 2.2, 4.0, 4.1
- Microsoft Visual C++, 32-bit Enterprise Edition, versions 4.2, 4.2b, 5.0sp1, 5.0sp2, 5.0, 6.0
- Microsoft Visual C++, 32-bit Professional Edition, versions 4.2, 5.0, 5.0sp1, 5.0sp2, 4.2b, 6.0
- Microsoft Visual C++, 32-bit Learning Edition, version 6.0
-------------------------------------------------------------------------------
SUMMARY
=======
The DUMPBIN utility, which is provided with the 32-bit version of Microsoft
Visual C++, combines the abilities of the LINK, LIB, and EXEHDR utilities. The
combination of these tools features the ability to provide information about the
format and symbols provided in executable, library, and DLL files.
This article provides a brief overview of some options and output produced by the
DUMPBIN utility. For more information about the DUMPBIN tool, consult your
product documentation.
MORE INFORMATION
================
The DUMPBIN command line options are listed below. Some of the output each
option provides is also listed.
/ALL Displays all available information except code disassembly. Use the /DISASM
option to display disassembly. You can use /RAWDATA:NONE with the /ALL option to
omit the raw binary details of the file.
Because the /ALL option is simply a combination of all the other options, an
example is not needed.
/ARCHIVEMEMBERS Displays minimal information about member objects in a library.
The size of the output file depends on the number of object modules in the
library. The following is part of the output from the Scrnsave.lib file:
Archive member name at 582: /0 ..\..\common\retail\scrnsave.obj
2FF359CC time/date Thu Jun 29 18:56:28 1995
uid
gid
100666 mode
214A size
correct header end
/DISASM Displays disassembly of code sections, using symbols if present in the
file.
The following is part of the disassembly code from the Lib.exe file:
00401000: 8B 44 24 08 mov eax,dword ptr [esp+8]
00401004: 68 00 20 40 00 push 402000h
00401009: 8B 4C 24 08 mov ecx,dword ptr [esp+8]
0040100D: 50 push eax
0040100E: 51 push ecx
0040100F: E8 0C 00 00 00 call 00401020
00401014: 33 C0 xor eax,eax
00401016: C3 ret
00401017: CC int 3
/EXPORTS Displays all definitions exported from an executable file or DLL.
MFC40.DLL produces the following export information:
Section contains the following Exports for MFC40.DLL
0 characteristics
30733286 time date stamp Wed Oct 04 18:19:02 1995
0.00 version
1 ordinal base
5782 number of functions
4 number of names
ordinal hint name
2 0 DllCanUnloadNow (00096182)
1 1 DllGetClassObject (0009611E)
3 2 DllRegisterServer (000961DB)
4 3 DllUnregisterServer (00096242)
/FPO Displays frame pointer optimization (FPO) records.
One of the MFC libraries, Nafxis.lib, provided us with some examples of frame
pointer optimization records:
FPO Data (1)
Use Has Frame
Address Proc Size Locals Prolog BP SEH Type Params
00000000 9 0 0 N N fpo 0
FPO Data (1)
Use Has Frame
Address Proc Size Locals Prolog BP SEH Type Params
00000000 11 0 0 N N fpo C
FPO Data (1)
Use Has Frame
Address Proc Size Locals Prolog BP SEH Type Params
00000000 3 0 0 N N fpo 0
/HEADERS Displays the file header and the header for each section. When used with
a library, it displays the header for each member object.
This information was displayed from the Resource Compiler, Rc.exe:
FILE HEADER VALUES
14C machine (i386)
6 number of sections
306F7A22 time date stamp Sun Oct 01 22:35:30 1995
0 file pointer to symbol table
1D1 number of symbols
E0 size of optional header
302 characteristics
Executable
32 bit word machine
Debug information stripped
OPTIONAL HEADER VALUES
10B magic #
2.60 linker version
1E00 size of code
1E00 size of initialized data
0 size of uninitialized data
1144 address of entry point
1000 base of code
3000 base of data
----- new -----
2BB0000 image base
1000 section alignment
200 file alignment
3 subsystem (Windows CUI)
4.00 operating system version
4.00 image version
3.50 subsystem version
8000 size of image
400 size of headers
62C8 checksum
100000 size of stack reserve
1000 size of stack commit
100000 size of heap reserve
1000 size of heap commit
0 [ 0] address [size] of Export Directory
5000 [ 3C] address [size] of Import Directory
6000 [ 394] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
0 [ 0] address [size] of Security Directory
7000 [ 21C] address [size] of Base Relocation Directory
3030 [ 38] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
0 [ 0] address [size] of Thread Storage Directory
0 [ 0] address [size] of Load Configuration Directory
268 [ 44] address [size] of Bound Import Directory
50A0 [ 64] address [size] of Import Address Table Directory
0 [ 0] address [size] of Reserved Directory
0 [ 0] address [size] of Reserved Directory
0 [ 0] address [size] of Reserved Directory
SECTION HEADER #1
.text name
1D24 virtual size
1000 virtual address
1E00 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
3C20 file pointer to line numbers
0 number of relocations
37E number of line numbers
60000020 flags
Code
(no align specified)
Execute Read
/IMPORTS Displays all definitions imported to an executable file or DLL.
The output displayed here is similar to the /EXPORTS output.
/LINENUMBERS Displays COFF line numbers. Line numbers exist in an object file if
it was compiled with the Program Database (/Zi), C7 Compatible (/Z7), or Line
Numbers Only (/Zd) switches. An executable file or DLL contains COFF line
numbers if it was linked with the Generate Debug Info (/DEBUG) and COFF Format
(/DEBUGTYPE:COFF) options.
An application generated using AppWizard displays line information data such
as the following:
LINENUMBERS #1
1E90 13 1ECD 13 1EF7 13 1F16 13 1F31 15
1F46 15 1F61 24 1F9A 27 1FD0 2A 2001 2B
/LINKERMEMBER[:{1|2}] Displays public symbols defined in a library. Specify the 1
argument to display symbols in object order, along with their offsets. Specify
the 2 argument to display offsets and index numbers of objects, and then list
the symbols in alphabetical order, along with the object index for each. To get
both outputs, specify /LINKERMEMBER without the number argument.
Winmmm.lib, the Windows Multimedia library, was used to get the following
sample of DUMPBIN output.
Archive member name at 8: /
2FB537E1 time/date Sat May 13 15:51:13 1995
uid
gid
0 mode
2864 size
correct header end
391 public symbols
556C _CloseDriver@12
58A0 _DefDriverProc@20
5BDC _DriverCallback@28
5F1C _DrvGetModuleHandle@4
626A _GetDriverModuleHandle@4
65C4 _NotifyCallbackData@20
6914 _OpenDriver@12
6C44 _PlaySound@12
6F70 _PlaySoundA@12
72A0 _PlaySoundW@12
/OUT:filename Specifies a filename for the output. By default, DUMPBIN displays
the information to standard output.
/RAWDATA[:{BYTES|SHORTS|LONGS|NONE}[,number]] Displays the raw contents of each
section in the file. The arguments control the format of the display, as shown
below:
Argument Result
BYTES The default. Contents are displayed in hexadecimal bytes,
and also as ASCII characters if they have a printed
representation.
SHORTS Contents are displayed as hexadecimal words.
LONGS Contents are displayed as hexadecimal longwords.
NONE Raw data is suppressed. This argument is useful to control
the output of /ALL.
number Displayed lines are set to a width that holds <number> values
per line.
The information generated with this option is quite large, this is a small
sample of output from an AppWizard application using the LONGS format:
RAW DATA #1
00000000 53EC8B55 00A15756 | E9004058 00000000 U[ASCII 239]_SVW[ASCII
237].|X@._...._
00000010 C95B5E5F EC8B55C3 | 5304EC83 4D895756 _^[++U[ASCII
239]_|[ASCII 226]_.SVW[ASCII 235]M_
00000020 3058B8FC 00E90040 | 5F000000 C3C95B5E n+X0@._.|..._^[++_
/RELOCATIONS Displays any relocations in the object or image.
Below is a small portion of the relocation output obtained from an AppWizard
application:
BASE RELOCATIONS #6
1000 virtual address, B0 SizeOfBlock
7 HIGHLOW
22 HIGHLOW
36 HIGHLOW
67 HIGHLOW
89 HIGHLOW
/SECTION:section Restricts the output to information on the specified section.
/SUMMARY Displays minimal information about sections, including total size. This
option is the default if no other option is specified.
Microsoft (R) COFF Binary File Dumper Version 3.00.5270
Copyright (C) Microsoft Corp 1992-1995. All rights reserved.
Dump of file tracer.exe
File Type: EXECUTABLE IMAGE
Summary
1000 .data
1000 .idata
1000 .rdata
1000 .reloc
1000 .rsrc
1000 .text
/SYMBOLS Displays the COFF symbol table. Symbol tables exist in all object files.
A COFF symbol table appears in an image file only if it is linked with the
Generate Debug Info and COFF Format options under Debug Info on the Debug
category for the linker (or the /DEBUG and /DEBUGTYPE:COFF options on the
command line).
An AppWizard application was used to obtain the following example:
COFF SYMBOL TABLE
000 000065D0 SECT5 notype Static | .rsrc$02
001 00000011 DEBUG notype Filename | .file
C:\code\test\testView.cpp
004 000041A0 SECT3 notype Static | $SG23289
005 00004018 SECT3 notype Static | _$S189$S23301
006 00004168 SECT3 notype Static | _THIS_FILE$S23282
007 00001E90 SECT1 notype Static | .text
Section length 2DE, #relocs 27, #linenums 22
009 00001EE2 SECT1 notype () Static | _$E188
00A 00001EF7 SECT1 notype () Static | _$E187
tag index 0000002E size 0000001F lines 000012DF next function 00000033
00C 000042AC SECT3 notype Static | __init_CTestView$S23291
00D 00003998 SECT2 notype Static | $T23440
00E 00003978 SECT2 notype Static | $T23438
00F 000039C0 SECT2 notype Static | $T23447
010 000039A0 SECT2 notype Static | $T23446
011 00000021 DEBUG notype Filename | .file
Additional query words: kbinf 1.00
======================================================================
Keywords : kbVC200 kbVC210 kbVC220 kbVC400 kbVC410 kbVC420 kbVC500 kbVC600
Technology : kbVCsearch kbVC400 kbAudDeveloper kbVC220 kbVC410 kbVC420 kbVC500 kbVC600 kbVC200 kbVC210 kbVC32bitSearch kbVC500SP1 kbVC500SP2 kbVC420b kbVC500Search
Version : winnt:2.0,2.1,2.2,4.0,4.1,4.2,4.2b,5.0,5.0sp1,5.0sp2,6.0
Issue type : kbinfo
=============================================================================
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
Copyright Microsoft Corporation 1986-2002.