如何区分用户定义/库函数和编译文件？
编辑：
我想要的是区分编译文件中的静态链接库函数和用户自己编写的函数（例如PE文件）。
如何实现这一目标？ （我正在考虑数据库比较，但我不知道任何数据库。）
顺便说一句，（在我问这个问题之前我就已经知道了）对于动态链接库函数，它们只是导入表（PE的）中的一个条目）。
我所说的库函数是指那些在库中定义的函数，例如 STL（我知道这是一个坏名字）。
我所说的用户定义函数是指由个体程序员编写的函数。
有没有任何程序化的方法来实现这个目标？
现在我正在考虑将二进制文件与数据库进行比较，但到目前为止我不知道任何数据库。
请推荐一个数据库或不同的方式作为答案。谢谢。
EDIT:
What I want is to distinguish statically linked library functions and user self-written functions within a compiled file (e.g. PE file).
How to achieve that? (I am thinking of database comparison but I do not know any database.)
By the way, (I have already known long before I asked this question) for dynamically linked library functions, they are just an entry in the import table (of PE).
By library functions, I mean those defined in libraries, such as STL (I know this is a bad name).
By user-defined functions, I mean those written by individual programmers.
Is there any programmatic way to achieve this goal?
Right now I am thinking about comparing binaries with a database, but I do not know any database so far.
Please recommend a database or a different way as an answer. Thank you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这个答案假设您想要分析一个标准的 Windows 可执行文件，该可执行文件动态链接到其他导入库（.lib 和非静态链接的相关 .dll 文件），如果是这种情况，您想要解释 PE（便携式可执行）文件结构。
这是一篇好文章，可以帮助您入门，其中包含有关转储PE 标头。
您需要重点关注外部库调用的导入表（.idata 部分）和在可执行文件内定义并标记为可导出的调用的导出表（.edata 部分）（通常仅存在于 .dll 文件中）。
对于静态库，其格式称为 COFF，并且有 Visual Studio 附带的 DUMPBIN 实用程序您可以使用它来快速查看您的 lib 文件，甚至可以根据需要转储代码的反汇编代码。
有关 COFF 文件结构的信息，请参阅这篇文章。
弄清楚函数调用是否来自 lib 会很棘手，但据我所知，代码中的大多数静态 lib 调用实际上都是 thunk 调用（对从 lib 复制的实际目标代码的简单 jmp 调用）并且很小大小（通常约为 5 个字节），而“用户定义”的不是 thunk，而是基于 bp 的帧调用。
This answer is assuming you want to analyze a standard Windows executable that is dynamically linked against other import libraries (.lib and assoicated .dll files that are not statically linked), and if this is the case, you want to interperet the PE (Portable Executable) file structure.
Here's a good article to get you started, with sample code on dumping the PE header.
You will want to focus on the Import table (.idata section) for external library calls, and the Export table (.edata section) for calls defined inside the executable and marked as exportable (usually this only exists in .dll files).
For static libraries, their format is called COFF, and there is the DUMPBIN utility that ships with Visual Studio that you can use to quickly peer into your lib files and even dump the disassembly of the code if you wanted.
For information on the structure of COFF files, see this article.
Figuring out if a function call is from a lib or not would be tricky, but from what I remember, most static lib calls in code are actually thunk calls (simple jmp calls to the actual object code copied in from the lib) and are small in size (usually around 5 bytes), while "user defined" ones are not thunks, and are bp-based framed calls.
当你的程序被链接时，静态函数和用户定义函数是
逐个包含文件。
因此，如果你转储 PE 文件的标头，并查看符号
表（如果使用 mingw32 或其他任何东西运行，则使用 objdump -x）
您将看到一个文件的名称，然后所有函数都从该文件导入，
在其他文件名及其功能之后...
或者如果您有调试信息，可能会更容易。
因此，将函数与文件链接后，您可以通过分析函数的文件名对函数进行排序。寻找扩展名（.c / .lib / .a）或检查您在某处拥有的文件列表。
小心消除 crt0 文件...
但是，这是一个棘手的解决方案，我不确定这是否适用于每个程序。
When your programm is linked, static functions and user-define functions are
include file by file.
So if you dump the header of a PE file, and look at the symbols
table (using objdump -x if you run with mingw32, or anything else)
you will see the name of a file and then all functions import from this one,
after an other file name and its functions...
Or if you have debug information, may be this can be easier.
So after you link functions with a file you can sort the functions by analysing their file name. Looking for extention (.c / .lib / .a) or check in a list of file you have somwhere.
Be carefull to eliminate crt0 files...
However this is kind a tricky solution and I'm not sure this'll work for every program.