// setup
DebugCreate(IDebugClient)
IDebugClient->QueryInterface(IDebugControl)
IDebugControl->SetOutputCallbacks()
IDebugClient->SetEventCallbacks()
// launch the helper process
IDebugClient->CreateProcessAndAttach(0, "host.exe", DEBUG_ONLY_THIS_PROCESS, 0, 0)
IDebugControl->WaitForEvent()
// set the default symbol options
IDebugClient->QueryInterface(IDebugSymbols3)
IDebugSymbols3->SetSymbolOptions(SymbolOptions);
// unload all the existing symbols
IDebugSymbols3->GetNumberModules()
foreach(module)
{
IDebugSymbols3->GetModuleParameters(ModParams)
IDebugSymbols3->GetModuleNames(ModParams.Base, moduleName)
IDebugSymbols3->Reload("/u " + moduleName")
}
// map the file to be disassembled into the relevant processes
MappedFile = MapAsDataFileInCurrentProcess("C:\Mod\\to\\disasm.dll")
IDebugControl->SetEffectiveProcessorType(MappedFile->NtHeaders.FileHeader.Machine)
MappedAddress = MapDataFileAsExeIntoHostExe(out MappedSize) // 1
// load it as a virtual module in the target process
IDebugSymbols3->Reload("/s /f /w <moduleName>=<MappedAddress>,0x<MappedSize>)
// check that it loaded where we want it
IDebugSymbols3->GetModuleByModuleName(<ModuleNameMinusExt>, &realModuleBase)
// if not, load a second virtual module at this address
// this is so any absolute addressed symbols can be resolved
if(realModuleBase != MappedFile->NtHeaders.OptionalHeader.ImageBase)
{
IDebugSymbols3->Reload("/s /f /w <moduleName>=<OptionalHeader.ImageBase>,0x<OptionalHeader.SizeOfImage>)
}
// get setup for the disassembly
IDebugControl->SetAssemblyOptions(DEBUG_ASMOPT_*)
From there you can enumerate the symbols using:
IDebugSymbols3::GetSymbolEntriesByName("<moduleName>!*", &numSymbols)
for(numSymbols)
{
IDebugSymbols3::GetSymbolEntryInformation(symId, &entry);
IDebugSymbols3::GetSymbolEntryString(symId)
}
or get the sections via investigating the Nt and section headers of the mapped file
and then output the disassembly via:
DEBUG_SYMBOL_ENTRY symEntry = /**/;
ULONG64 endOfInstruction = symEntry.Offset;
ULONG64 endOfSymbol = symEntry.Offset + symEntry.Size; // 2
while(endOfInstruction < endOfSymbol)
{
IDebugControl::OutputDisassembly(DEBUG_OUTCTL_THIS_CLIENT, endOfInstruction, DEBUG_DISASM_MATCHING_SYMBOLS, &endOfInstruction);
}
--- end

1. MapDataFileAsExeIntoHostExe() should map the file and its sections as if it were to be executed, e.g. with the section alignment specified in the NtHeader. The handle to the host.exe process is given to you by DbgEng through the IDebugEventCallbacks::CreateProcess callback. Use MapViewOfFileEx or equivalent to attempt to map the file at it's preferred base address (MappedFile->NtHeaders.OptionalHeader.ImageBase)
2. Some symbols don't have a size entry. In this case, DisAsm sorts all symbols by offset and takes the start of the next symbol as the end of the current one.