Debugging Tool Defined Text Symbol Maps

Defined-text symbol maps

← Debugging Tools and Commands

A defined-text symbol map associates executable RVAs with known function labels when full stack or source-line decoding is unavailable.

Property	Details
Supported OS	Generated on any host with compatible GNU Binutils; consumed cross-platform.
Install	Use the exact PE/ELF and the repository source-pinned extraction helper.
Verify	x86_64-w64-mingw32-objdump --version
Primary output	See the workflow below.

When to use it

When full stack/source decoding is unavailable, an exact-PE defined-symbol map can still bound an instruction pointer to a known function extent.

The retained WPA attribution packet generated a map with 60,273 defined text labels from the exact executable.

Its reproducible helper is documented in the evidence packet. Conceptually:

bash extract-defined-text-symbols.sh /path/to/exact/xemu.exe rebuilt-symbols.tsv.gz
sha256sum rebuilt-symbols.tsv.gz

To find the nearest defined label at or below a known RVA:

gzip -dc defined-text-symbols.tsv.gz |
  TARGET_RVA=0x00296c90 perl -F'\t' -ane '
    next if /^#/;
    $last=$_ if hex($F[1]) <= hex($ENV{TARGET_RVA});
    END { print $last if defined $last }
  '

Read the result carefully

A nearest label can say “this IP is within the bounded extent beginning at pgraph_vk_finish.” It cannot recover a missing caller stack or tell whether that common function was copying, submitting, or waiting at the sampled moment.

Treat it as function ownership, not full causality.

---

Boundaries and common mistakes

Nearest-label attribution establishes a bounded owner only when section limits and the next symbol boundary are respected. It does not reconstruct callers, inline chains, or runtime cause.

Hash the map and the source executable. Never reuse a map for a different executable even when source commits match.

Evidence to retain

• Tool name and exact version.
• Source commit/tree and executable SHA-256.
• The complete command or saved profile used.
• Input artifact hashes and the explicitly selected time or address range.
• Raw output plus any derived report; do not retain only a screenshot or conclusion.
• Admission failures, warnings, dropped events, incomplete rows, or unsupported operations.

Official references

• GNU objdump
• GNU nm

Related xemu guides

• Debugging Tools and Commands
• Debugging Lag and Hot Paths
• Performance Methodology