Skip to content

Releases: dragokas/ObfSymbolsEx

Release list

1.2

Choose a tag to compare

@dragokas dragokas released this 17 Sep 10:30
Add symbol-server download, simple reports, and version banner

- PE input detection now uses MZ/PE magic instead of file extension, so
  .ocx/.sys/etc. (not just .exe/.dll) go through the binary-loading path.
- New PdbSymbolDownloader class: for a PE input, locates and downloads its
  matching PDB from a symbol server before falling back to DIA's own
  loadDataForExe(). Tries, in order, an optional -srv= override, every
  srv*/symsrv* entry in _NT_SYMBOL_PATH, then the default Microsoft public
  symbol server; logs each URL it tries. Reuses an already-present PDB next
  to ObfSymbolsEx.exe or the input file if its GUID (parsed directly from
  the PDB's MSF header) matches -- Age is deliberately not compared, since
  it's an MSF rewrite counter, not a timestamp, and commonly differs for an
  otherwise-correct symbol-server PDB.
- New _simple_sort_by_class.sym / _simple_sort_by_name.sym reports: a bare
  "Name(Signature) -> ReturnType" line per symbol, sorted by the
  fully-qualified name or by just the bare method name respectively; both
  still honor -fc/-fm filtering.
- Console banner now prints the tool's own version (Version.h, 1.2).

README.md, UNIT_TESTS.md, and unit-tests.ps1 (14 new assertions) updated
to match. Full 74-test suite passes.

1.1

1.1

Choose a tag to compare

@dragokas dragokas released this 15 Sep 16:27
Add -fc+/-fc-/-fm+/-fm- report filtering switches

Adds optional, repeatable command-line switches (4th argument onward) to
narrow every output file to matching classes/lines:
  -fc+WORD / -fc-WORD   include/exclude by class name
  -fm+WORD / -fm-WORD   include/exclude by whole line
WORD is always a case-insensitive substring check; may be quoted. Multiple
+ rules OR together, multiple - rules OR together, + is applied before -.

New classes, split per the requested separation of concerns:
- CommandLineParser (.h/.cpp): owns the whole argv parsing -- positional
  input/output plus the filter switches -- not just the new ones.
- SymbolFilter (.h/.cpp): holds the parsed -fc/-fm rules and implements the
  include-then-exclude matching logic, used by every report writer.

Per-file filtering rules (matches the spec given):
- server.sym/server_obfuscated.sym: -fc tests the symbol's class name;
  -fm tests the whole formatted line (so it can match PUBLIC/PRIVATE too).
  The obfuscated file's -fm decision is computed from the same real-name
  line text as server.sym (its own printed text has no name/signature/
  source file left to search), so both files keep identical symbol sets
  for a given filter.
- server_vtable*.sym / server_vtable_classes.sym / _inheritance.sym:
  -fc tests a group's header class name and keeps/drops the whole group
  (header + members) at once; -fm tests each member/tree line individually.
  server_vtable_obfuscated.sym's -fm decision is likewise computed from the
  real method identity regardless of its own includeRealNames=false text,
  keeping it in lockstep with server_vtable.sym.

Verified against the exact worked example from the spec
(-fc+CBaseEntity -fm+model -fm-Index against a real ~40k-symbol PDB) --
server_vtable_classes.sym output matches byte-for-byte.

Also:
- README: new "Filtering output" section (switch table + the CBaseEntity
  example) under "Using ObfSymbolsEx", plus a one-line mention in the
  "Added in this fork" list.
- unit-tests.ps1: 16 new assertions (substring vs exact matching, case
  insensitivity, quoted WORD, +/- combination mirroring the README example,
  free-function exclusion, unrecognized-switch exit code) plus a matching
  UNIT_TESTS.md coverage entry. All 60 tests pass (44 pre-existing + 16
  new); the full solution still builds clean via build-all.ps1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1.0

1.0

Choose a tag to compare

@dragokas dragokas released this 14 Sep 15:46
Restructure README: Quick Start to the top, drop remaining test-info …