Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Win32 API to enumerate dll export functions?

I found similar questions but no answer to what I am looking for. So here goes:

For a native Win32 dll, is there a Win32 API to enumerate its export function names?

like image 389
user15071 Avatar asked Jul 14 '09 21:07

user15071


1 Answers

dumpbin /exports is pretty much what you want, but that's a developer tool, not a Win32 API.

LoadLibraryEx with DONT_RESOLVE_DLL_REFERENCES is heavily cautioned against, but happens to be useful for this particular case – it does the heavy lifting of mapping the DLL into memory (but you don't actually need or want to use anything from the library), which makes it trivial for you to read the header: the module handle returned by LoadLibraryEx points right at it.

#include <winnt.h> HMODULE lib = LoadLibraryEx("library.dll", NULL, DONT_RESOLVE_DLL_REFERENCES); assert(((PIMAGE_DOS_HEADER)lib)->e_magic == IMAGE_DOS_SIGNATURE); PIMAGE_NT_HEADERS header = (PIMAGE_NT_HEADERS)((BYTE *)lib + ((PIMAGE_DOS_HEADER)lib)->e_lfanew); assert(header->Signature == IMAGE_NT_SIGNATURE); assert(header->OptionalHeader.NumberOfRvaAndSizes > 0); PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY)((BYTE *)lib + header->     OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); assert(exports->AddressOfNames != 0); BYTE** names = (BYTE**)((int)lib + exports->AddressOfNames); for (int i = 0; i < exports->NumberOfNames; i++)     printf("Export: %s\n", (BYTE *)lib + (int)names[i]); 

Totally untested, but I think it's more or less correct. (Famous last words.)

like image 164
ephemient Avatar answered Sep 22 '22 00:09

ephemient