原本是要找有沒有方法可以讓objdump -d 的時候,是不是可以順便把 export function name也一起顯示出來, 但都找不到方法.
不過也因此找到讓gdb直接disassembly某個export API.
主要是利用 gdb 的 -ex 的用法.
不過, -batch 也可以在最後加個 -ex 'quit' 來取代.

舉例如下:
$ /c/mingw64/bin/gdb -batch -ex 'file c:\\temp\\ntdll.dll' -ex 'disassemble NtGetTickCount'
Dump of assembler code for function ntdll!NtGetTickCount:
   0x0000000078f08660 <+0>:     mov    0x7ffe0004,%ecx
   0x0000000078f08667 <+7>:     mov    0x7ffe0320,%rax
   0x0000000078f0866f <+15>:    imul   %rcx,%rax
   0x0000000078f08673 <+19>:    shr    $0x18,%rax
   0x0000000078f08677 <+23>:    retq
   0x0000000078f08678 <+24>:    nop
   0x0000000078f08679 <+25>:    nop
   0x0000000078f0867a <+26>:    nop
   0x0000000078f0867b <+27>:    nop
   0x0000000078f0867c <+28>:    nop
   0x0000000078f0867d <+29>:    nop
   0x0000000078f0867e <+30>:    nop
   0x0000000078f0867f <+31>:    nop
End of assembler dump.

$ /c/mingw64/bin/gdb  -ex 'file c:\\temp\\ntdll.dll' -ex 'disassemble NtGetTickCount' -ex 'quit'
Dump of assembler code for function ntdll!NtGetTickCount:
   0x0000000078f08660 <+0>:     mov    0x7ffe0004,%ecx
   0x0000000078f08667 <+7>:     mov    0x7ffe0320,%rax
   0x0000000078f0866f <+15>:    imul   %rcx,%rax
   0x0000000078f08673 <+19>:    shr    $0x18,%rax
   0x0000000078f08677 <+23>:    retq
   0x0000000078f08678 <+24>:    nop
   0x0000000078f08679 <+25>:    nop
   0x0000000078f0867a <+26>:    nop
   0x0000000078f0867b <+27>:    nop
   0x0000000078f0867c <+28>:    nop
   0x0000000078f0867d <+29>:    nop
   0x0000000078f0867e <+30>:    nop
   0x0000000078f0867f <+31>:    nop
End of assembler dump.