Symbols list

The symbol view is accessed using the F5 shortcut and lists all symbols (imports, exports, internal functions and types) extracted by Malcat. Clicking on a symbol shows the references to this symbol, while double-clicking it navigates to the address of the symbol.


The symbols list in a nutshell


In the symbols list, symbols are displayed in a tree ('.' is used as separators to build the tree), alongside their address and the number of cross references pointing to them. They are furthermore grouped by type. The types are given below:


User labels. These are the ones you can add using the context menu RightClick ‣ Add/edit label. Listing them here allow you to have an overview of your custom locations.


All imported APIs, as reported by Malcat File parsers.


All exported function, as reported by Malcat File parsers.


Here are listed all functions having a name. The name can come from different sources:

  • From the file’s metadata, e.g. the .NET MethodDef table

  • From debug informations, e.g. the ELF .symtab section

  • From a FLIRT signatures

Not that anonymous functions are not listed there, because they don’t have any symbol defined. I you want to see the list of all functions


Here you will find all variable-related symbols. These could be symbols for global variables for instance. Constants identified by Malcat’s Known patterns identification are also listed there.


Here are listed all symbols pointing to type-definition structures. These kind fo symbols can can from different sources:

  • From the file’s metadata, e.g. the .NET TypeDef table

  • From RTTI information, e.g. the MSVC vtables


This category is currently only used by us when debugging some issues. But in the future, there will be python bindings to add symbols to this category. This will be a way for scripts to add symbols, without polluting the user-defined labels.

By defaults, all nodes of the tree beyond the first level of hierarchy are collapsed. You can expand them all by clicking on the checkbox :menuselection:Expand all located on the top of the view.

Symbol preview / goto

Clicking on a symbol will display all the incoming references to the symbol’s address in the quickview panel.

If you double-click the symbol, you will jump to the start of the symbol. The best view is chosen automatically. It can be the Hexadecimal view or the Structure/text view (the most recently used view is chosen) if the symbol lies outside of a recognized function, otherwise it will be the Disassembly view.




Select single symbol / display quick preview


Go to symbol address


The symbols view can potentially display a very large amount of symbols. To make things easier, it is possible to filter the displayed symbols by name using the search box at the top of the string. Filtering is done immediately, no need to press Enter. Note that the tree will be automatically expanded to display search results.




Set focus to the view’s search box

Copy single/multi

From within the symbols view you can select one or multiple symbols at once, using the usual mouse shortcuts. If you hit Ctrl+C afterwards, you will copy all selected fully-qualified names to the clipboard. Multiple symbols are separated using line returns.




Select single symbol / set start of symbols selection


Set end of symbols selection


Add/remove single symbol to/from symbols selection


Copy selected symbols