Export Forwarders von DLLs auflisten ...

[Assarbad]

@Mods: Ich finde das gehört in die CodeLib und nicht nach OS/Freeware.

Hiho,

da ich kein solches Tool gefunden habe, mußte ich's mir selbst schreiben ... es listet alle Export Forwarders in der als Parameter übergebenen DLL auf.

Download als ZIP hier: http://assarbad.net/stuff/!export/export_forw.zip

Hier der Source. Keine Sicherheitsabfragen ..., das Tool wurde in ca 50 min geschrieben!:

Delphi-Quellcode:

{
Visit the author's page at [url]http://assarbad.net[/url]
Author : -=Assarbad=-
License: no warranties, no restrictions, PUBLIC DOMAIN
}
program listforwarders;
{$APPTYPE CONSOLE}
uses
  Windows,
  ImageHlp;

type
  TWordArr = array[0..0] of Word;
  PWordArr = ^TWordArr;
  TDWordArr = array[0..0] of DWORD;
  PDWordArr = ^TDWordArr;

procedure ShowForwarders(filename: string);
var
  li: LoadedImage;
  dwEntry,
    dwExportsRVA_end,
    dwExportsRVA,
    dwExportsSize: DWORD;
  lpHeader: PImageSectionHeader;
  lpExportDir: PImageExportDirectory;
  lpFuncs: PDWORD;
  pwOrdinals: PWordArr;
  lpFuncNames: PDWordArr;
  szTemp, szTemp1, szTemp2: PChar;
  i, j: Integer;
begin
  if MapAndLoad(@filename[1], nil, @li, False, True) then
  try
    if (li.Characteristics and IMAGE_FILE_DLL <> 0) and not (li.fSystemImage) then
    try
      dwExportsRVA := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
      dwExportsSize := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
      dwExportsRVA_end := dwExportsRVA + dwExportsSize;
      lpExportDir := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwExportsRVA, lpHeader);
      szTemp1 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpExportDir^.Name, lpHeader);
      lpFuncs := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfFunctions), lpHeader);
      pwOrdinals := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNameOrdinals), lpHeader);
      lpFuncNames := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNames), lpHeader);
      for i := 0 to lpExportDir^.NumberOfFunctions - 1 do
      begin
        dwEntry := PDWORD(lpfuncs)^;
        if dwEntry = 0 then
          continue;
        if (dwEntry >= dwExportsRVA) and (dwEntry <= dwExportsRVA_end) then
        begin
          szTemp := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwEntry, lpHeader);
          for j := 0 to lpExportDir^.NumberOfNames - 1 do
            if pwOrdinals[j] = i then
            begin
              szTemp2 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpFuncNames^[j], lpHeader);
              Write('[',string(szTemp1),']',string(szTemp2));
            end;
          Writeln(' -> ', string(szTemp));
        end;
        inc(lpFuncs);
      end;
    finally
    end;
  finally
    UnMapAndLoad(@li);
  end;
end;

begin
  if paramstr(1)<>'' then
  ShowForwarders(paramstr(1));
end.

Und ein kleines Beispielskript, welches die Export Forwarders aller DLLs im aktuellen (und dessen Unterverzeichnissen) ausgibt:

Code:

@echo off
rem Visit the author's page at [url]http://assarbad.net[/url]
rem Author : -=Assarbad=-
rem License: no warranties, no restrictions, PUBLIC DOMAIN
for /f "tokens=*" %%i in ('dir /b /s *.dll') do (
  listforwarders "%%i"
)