Funktionen / Proceduren die ein anderes Programm benutzt

[brechi]

hab da mal was gemacht:

Delphi-Quellcode:

procedure ListImports(dllbasep, importp: pointer);
type timportblock = record
                      Characteristics: cardinal;
                      TimeDateStamp: cardinal;
                      ForwarderChain: cardinal;
                      Name: pchar;
                      FirstThunk: pointer;
                    end;
     pimportblock = ^timportblock;
var myimport: pimportblock;
    myimportf: pointer;
    thunks: ^pointer;
    dllname, importname: pchar;
begin
  myimport := importp;
  dllname := pointer(integer(dllbasep)+integer(myimport^.name));
  while (myimport^.FirstThunk <> nil) do
  begin
    thunks := pointer(integer(myimport^.FirstThunk)+integer(dllbasep));
    while thunks^ <> nil do
    begin
      if (cardinal(thunks^) > cardinal(dllbasep)) then
      begin
        importname := pchar(cardinal(thunks^) mod $10000);
      end else
      begin
        myimportf := pointer(integer(dllbasep)+integer(thunks^)+2);
        importname := pchar(myimportf);
      end;
      Form1.ListBox1.items.add(importname+' impoted from '+dllname);
      inc(thunks,1);
    end;
    myimport := pointer(integer(myimport)+sizeof(timportblock));

    dllname := pointer(integer(dllbasep)+integer(myimport^.name));
  end;
end;


procedure ShowImports(dllname: pchar); stdcall;
var IDH: PImageDosHeader;
    read,memsize: cardinal;
    filemem, all: pointer;
    INH: PImageNtHeaders;
    seca: cardinal;
    sectionh: PImageSectionHeader;
    i, h: integer;
    filesize: cardinal;
begin
  h := CreateFile(dllname,GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if h <> -1 then
  begin
    filesize := GetFileSize(h,nil);
    filemem := VirtualAlloc(nil,filesize,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    if filemem <> nil then
    begin
      readfile(h,filemem^,filesize,read,nil);
      IDH := filemem;
      if IDH^.e_magic = IMAGE_DOS_SIGNATURE then
      begin
        INH := pointer(cardinal(filemem)+cardinal(IDH^._lfanew));
        if INH^.Signature = IMAGE_NT_SIGNATURE then
        begin
          sectionh := pointer(cardinal(INH)+cardinal(sizeof(TImageNtHeaders)));
          memsize := INH^.OptionalHeader.SizeOfImage;
          if memsize <> 0 then
          begin
            all := virtualalloc(nil,integer(memsize),MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
            if all <> nil then
            begin
              seca := INH^.FileHeader.NumberOfSections;
              for i := 0 to seca-1 do
              begin
                CopyMemory(pointer(cardinal(all)+sectionh^.VirtualAddress),
                  pointer(cardinal(filemem)+cardinal(sectionh^.PointerToRawData)),
                  sectionh^.SizeOfRawData);
                sectionh := pointer(integer(sectionh)+sizeof(TImageSectionHeader));
              end;
              ListImports(pointer(cardinal(all)), pointer(cardinal(all)+INH^.OptionalHeader.DataDirectory[1].VirtualAddress));
            end;
          end;
        end;
      end;
      VirtualFree(filemem,filesize,MEM_DECOMMIT);
    end;
    CloseHandle(h);
  end;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  ShowImports(pchar(paramstr(0)));
end;