...Export Forwarders von DLLs auflisten?

Gast

Hiho,

da ich kein solches Tool gefunden habe, mußte ich's mir selbst schreiben

... es listet alle Export Forwarders in der als Parameter übergebenen DLL auf.

Download als ZIP hier: assarbad.net/stuff/!export/export_forw.zip

Hier der Source. Keine Sicherheitsabfragen ..., das Tool wurde in ca 50 min geschrieben!:

Delphi-Quelltext

markieren

1:

2:

3:

4:

5:

6:

7:

8:

9:

10:

11:

12:

13:

14:

15:

16:

17:

18:

19:

20:

21:

22:

23:

24:

25:

26:

27:

28:

29:

30:

31:

32:

33:

34:

35:

36:

37:

38:

39:

40:

41:

42:

43:

44:

45:

46:

47:

48:

49:

50:

51:

52:

53:

54:

55:

56:

57:

58:

59:

60:

61:

62:

63:

64:

65:

66:

67:

68:

69:

70:

71:

72:

73:

{

Visit the author's page at http://assarbad.net

Author : -=Assarbad=-

License: no warranties, no restrictions, PUBLIC DOMAIN

}

program listforwarders;

{$APPTYPE CONSOLE}

uses

Windows,

ImageHlp;

type

TWordArr = array[0..0] of Word;

PWordArr = ^TWordArr;

TDWordArr = array[0..0] of DWORD;

PDWordArr = ^TDWordArr;

procedure ShowForwarders(filename: string);

var

li: LoadedImage;

dwEntry,

dwExportsRVA_end,

dwExportsRVA,

dwExportsSize: DWORD;

lpHeader: PImageSectionHeader;

lpExportDir: PImageExportDirectory;

lpFuncs: PDWORD;

pwOrdinals: PWordArr;

lpFuncNames: PDWordArr;

szTemp, szTemp1, szTemp2: PChar;

i, j: Integer;

begin

if MapAndLoad(@filename[1], nil, @li, False, True) then

try

if (li.Characteristics and IMAGE_FILE_DLL <> 0) and not (li.fSystemImage) then

try

dwExportsRVA := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;

dwExportsSize := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;

dwExportsRVA_end := dwExportsRVA + dwExportsSize;

lpExportDir := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwExportsRVA, lpHeader);

szTemp1 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpExportDir^.Name, lpHeader);

lpFuncs := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfFunctions), lpHeader);

pwOrdinals := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNameOrdinals), lpHeader);

lpFuncNames := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNames), lpHeader);

for i := 0 to lpExportDir^.NumberOfFunctions - 1 do

begin

dwEntry := PDWORD(lpfuncs)^;

if dwEntry = 0 then

continue;

if (dwEntry >= dwExportsRVA) and (dwEntry <= dwExportsRVA_end) then

begin

szTemp := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwEntry, lpHeader);

for j := 0 to lpExportDir^.NumberOfNames - 1 do

if pwOrdinals[j] = i then

begin

szTemp2 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpFuncNames^[j], lpHeader);

Write('[',string(szTemp1),']',string(szTemp2));

end;

Writeln(' -> ', string(szTemp));

end;

inc(lpFuncs);

end;

finally

end;

finally

UnMapAndLoad(@li);

end;

begin

if paramstr(1)<>'' then

ShowForwarders(paramstr(1));

end.

Und ein kleines Beispielskript, welches die Export Forwarders aller DLLs im aktuellen (und dessen Unterverzeichnissen) ausgibt:

Quelltext

markieren

1:

2:

3:

4:

5:

6:

7:

@echo off

rem Visit the author's page at http://assarbad.net

rem Author : -=Assarbad=-

rem License: no warranties, no restrictions, PUBLIC DOMAIN

for /f "tokens=*" %%i in ('dir /b /s *.dll') do (

listforwarders "%%i"

)