Repository navigation
Releases: dragokas/ObfSymbolsEx
Releases · dragokas/ObfSymbolsEx
Release list
1.2
Add symbol-server download, simple reports, and version banner - PE input detection now uses MZ/PE magic instead of file extension, so .ocx/.sys/etc. (not just .exe/.dll) go through the binary-loading path. - New PdbSymbolDownloader class: for a PE input, locates and downloads its matching PDB from a symbol server before falling back to DIA's own loadDataForExe(). Tries, in order, an optional -srv= override, every srv*/symsrv* entry in _NT_SYMBOL_PATH, then the default Microsoft public symbol server; logs each URL it tries. Reuses an already-present PDB next to ObfSymbolsEx.exe or the input file if its GUID (parsed directly from the PDB's MSF header) matches -- Age is deliberately not compared, since it's an MSF rewrite counter, not a timestamp, and commonly differs for an otherwise-correct symbol-server PDB. - New _simple_sort_by_class.sym / _simple_sort_by_name.sym reports: a bare "Name(Signature) -> ReturnType" line per symbol, sorted by the fully-qualified name or by just the bare method name respectively; both still honor -fc/-fm filtering. - Console banner now prints the tool's own version (Version.h, 1.2). README.md, UNIT_TESTS.md, and unit-tests.ps1 (14 new assertions) updated to match. Full 74-test suite passes.
1.1
Add -fc+/-fc-/-fm+/-fm- report filtering switches Adds optional, repeatable command-line switches (4th argument onward) to narrow every output file to matching classes/lines: -fc+WORD / -fc-WORD include/exclude by class name -fm+WORD / -fm-WORD include/exclude by whole line WORD is always a case-insensitive substring check; may be quoted. Multiple + rules OR together, multiple - rules OR together, + is applied before -. New classes, split per the requested separation of concerns: - CommandLineParser (.h/.cpp): owns the whole argv parsing -- positional input/output plus the filter switches -- not just the new ones. - SymbolFilter (.h/.cpp): holds the parsed -fc/-fm rules and implements the include-then-exclude matching logic, used by every report writer. Per-file filtering rules (matches the spec given): - server.sym/server_obfuscated.sym: -fc tests the symbol's class name; -fm tests the whole formatted line (so it can match PUBLIC/PRIVATE too). The obfuscated file's -fm decision is computed from the same real-name line text as server.sym (its own printed text has no name/signature/ source file left to search), so both files keep identical symbol sets for a given filter. - server_vtable*.sym / server_vtable_classes.sym / _inheritance.sym: -fc tests a group's header class name and keeps/drops the whole group (header + members) at once; -fm tests each member/tree line individually. server_vtable_obfuscated.sym's -fm decision is likewise computed from the real method identity regardless of its own includeRealNames=false text, keeping it in lockstep with server_vtable.sym. Verified against the exact worked example from the spec (-fc+CBaseEntity -fm+model -fm-Index against a real ~40k-symbol PDB) -- server_vtable_classes.sym output matches byte-for-byte. Also: - README: new "Filtering output" section (switch table + the CBaseEntity example) under "Using ObfSymbolsEx", plus a one-line mention in the "Added in this fork" list. - unit-tests.ps1: 16 new assertions (substring vs exact matching, case insensitivity, quoted WORD, +/- combination mirroring the README example, free-function exclusion, unrecognized-switch exit code) plus a matching UNIT_TESTS.md coverage entry. All 60 tests pass (44 pre-existing + 16 new); the full solution still builds clean via build-all.ps1. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>