Tweet
the code below is a quick port from c++, that works for me
in my actual code. there are no dependencies to any helper
dll's.
The function EnumFunctions(fName, hw_cmb) enumerates all funnctions in the
executable module fName and puts any found function in the
combobox hw_cmb. if you want to compile, you must include
win32api.inc
------------------
in my actual code. there are no dependencies to any helper
dll's.
The function EnumFunctions(fName, hw_cmb) enumerates all funnctions in the
executable module fName and puts any found function in the
combobox hw_cmb. if you want to compile, you must include
win32api.inc
Code:
'#COMPILE DLL
'#INCLUDE "win32api.inc"
%IMAGE_DOS_SIGNATURE = &H5A4D '// MZ
%IMAGE_NT_SIGNATURE = &H00004550 '// PE00
%IMAGE_SIZEOF_SHORT_NAME = 8
%IMAGE_SIZEOF_SECTION_HEADER = 40
UNION MISC
PhysicalAddress AS DWORD
VirtualSize AS DWORD
END UNION
TYPE IMAGE_SECTION_HEADER
Name_(%IMAGE_SIZEOF_SHORT_NAME - 1) AS BYTE
Misc AS MISC
VirtualAddress AS DWORD
SizeOfRawData AS DWORD
PointerToRawData AS DWORD
PointerToRelocations AS DWORD
PointerToLinenumbers AS DWORD
NumberOfRelocations AS WORD
NumberOfLinenumbers AS WORD
Characteristics AS DWORD
END TYPE
TYPE IMAGE_DATA_DIRECTORY
VirtualAddress AS DWORD
nSize AS DWORD
END TYPE
TYPE IMAGE_OPTIONAL_HEADER
'
' Standard fields.
'
Magic AS WORD
MajorLinkerVersion AS BYTE
MinorLinkerVersion AS BYTE
SizeOfCode AS DWORD
SizeOfInitializedData AS DWORD
SizeOfUninitializedData AS DWORD
AddressOfEntryPoint AS DWORD
BaseOfCode AS DWORD
BaseOfData AS DWORD
'
' NT additional fields.
'
ImageBase AS DWORD
SectionAlignment AS DWORD
FileAlignment AS DWORD
MajorOperatingSystemVersion AS WORD
MinorOperatingSystemVersion AS WORD
MajorImageVersion AS WORD
MinorImageVersion AS WORD
MajorSubsystemVersion AS WORD
MinorSubsystemVersion AS WORD
Reserved1 AS DWORD
SizeOfImage AS DWORD
SizeOfHeaders AS DWORD
CheckSum AS DWORD
Subsystem AS WORD
DllCharacteristics AS WORD
SizeOfStackReserve AS DWORD
SizeOfStackCommit AS DWORD
SizeOfHeapReserve AS DWORD
SizeOfHeapCommit AS DWORD
LoaderFlags AS DWORD
NumberOfRvaAndSizes AS DWORD
DataDirectory(%IMAGE_NUMBEROF_DIRECTORY_ENTRIES-1) AS IMAGE_DATA_DIRECTORY
END TYPE
TYPE IMAGE_FILE_HEADER
Machine AS WORD
NumberOfSections AS WORD
TimeDateStamp AS DWORD
PointerToSymbolTable AS DWORD
NumberOfSymbols AS DWORD
SizeOfOptionalHeader AS WORD
Characteristics AS WORD
END TYPE
TYPE IMAGE_NT_HEADERS
Signature AS DWORD
FileHeader AS IMAGE_FILE_HEADER
OptionalHeader AS IMAGE_OPTIONAL_HEADER
END TYPE
TYPE IMAGE_EXPORT_DIRECTORY
Characteristics AS DWORD
TimeDateStamp AS DWORD
MajorVersion AS WORD
MinorVersion AS WORD
nName AS DWORD
nBase AS DWORD
NumberOfFunctions AS DWORD
NumberOfNames AS DWORD
AddressOfFunctions AS DWORD
AddressOfNames AS DWORD
AddressOfNameOrdinals AS DWORD
END TYPE
TYPE IMAGE_DOS_HEADER ' DOS .EXE header
e_magic AS WORD
e_cblp AS WORD
e_cp AS WORD
e_crlc AS WORD
e_cparhdr AS WORD
e_minalloc AS WORD
e_maxalloc AS WORD
e_ss AS WORD
e_sp AS WORD
e_csum AS WORD
e_ip AS WORD
e_cs AS WORD
e_lfarlc AS WORD
e_ovno AS WORD
e_res(3) AS WORD
e_oemid AS WORD
e_oeminfo AS WORD
e_res2(9) AS WORD
e_lfanew AS LONG
END TYPE
FUNCTION IMAGE_FIRST_SECTION(pNTHeader AS IMAGE_NT_HEADERS PTR ) AS DWORD
FUNCTION = pNTHeader + 24 + @pNTHeader.FileHeader.SizeOfOptionalHeader
END FUNCTION
FUNCTION GetEnclosingSectionHeader(BYVAL rva AS DWORD, pNTHeader AS IMAGE_NT_HEADERS PTR) AS DWORD
DIM section AS IMAGE_SECTION_HEADER PTR
DIM i AS LONG
section = IMAGE_FIRST_SECTION(BYVAL pNTHeader)
FOR i=0 TO @pNTHeader.FileHeader.NumberOfSections
' Is the RVA within this section?
IF ( (rva >= @section.VirtualAddress) AND (rva < (@section.VirtualAddress + @section.Misc.VirtualSize))) THEN
FUNCTION = section
EXIT FUNCTION
END IF
section = section + SIZEOF(@section)
NEXT
END FUNCTION
FUNCTION DumpExportsSection(BYVAL pBase AS DWORD, BYVAL hw_cmb AS LONG, pNTHeader AS IMAGE_NT_HEADERS PTR) AS LONG
DIM pExportDir AS IMAGE_EXPORT_DIRECTORY PTR
DIM pHeader AS IMAGE_SECTION_HEADER PTR
DIM delta AS LONG
DIM i AS DWORD
DIM pFunctions AS DWORD PTR
DIM pOrdinals AS WORD PTR
DIM pNames AS DWORD PTR
DIM exportsStartRVA AS DWORD
DIM exportsEndRVA AS DWORD
DIM s AS STRING
DIM entryPointRVA AS DWORD
DIM j AS DWORD
DIM flag AS LONG
DIM pFunction AS ASCIIZ * 256
DIM sLen AS LONG
DIM cPos AS LONG
exportsStartRVA = @pNTHeader.OptionalHeader.DataDirectory(%IMAGE_DIRECTORY_ENTRY_EXPORT).VirtualAddress
exportsEndRVA = exportsStartRVA + @pNTHeader.OptionalHeader.DataDirectory(%IMAGE_DIRECTORY_ENTRY_EXPORT).nSize
pHeader = GetEnclosingSectionHeader( exportsStartRVA, BYVAL pNTHeader )
IF pHeader = 0 THEN
FUNCTION = 0
EXIT FUNCTION
END IF
delta = @pHeader.VirtualAddress - @pHeader.PointerToRawData
pExportDir = pBASE + exportsStartRVA - delta
pFunctions = @pExportDir.AddressOfFunctions - delta + pBase
pOrdinals = @pExportDir.AddressOfNameOrdinals - delta + pBase
pNames = @pExportDir.AddressOfNames - delta + pBase
FOR i = 0 TO @pExportDir.NumberOfFunctions - 1
entryPointRVA = @pFunctions[i]
j = 0
flag = 0
IF entryPointRVA <> 0 THEN
' // See IF this FUNCTION has an associated NAME exported FOR it.
FOR j=0 TO @pExportDir.NumberOfNames - 1
IF @pOrdinals[j] = i THEN
sLen = wsprintf(pFunction, "%s", BYVAL @pNames[j] - delta + pBase, BYVAL i + @pExportDir.nBase)
IF (UCASE$(LEFT$(pFunction, sLen)) <> "LIBMAIN") AND (UCASE$(LEFT$(pFunction, sLen)) <> "DLLMAIN") THEN
IF hw_cmb <> 0 THEN
cPos = SendMessage(hw_cmb, %CB_ADDSTRING, 0&, VARPTR(pFunction))
END IF
END IF
flag = 1
END IF
NEXT
' // Is it a forwarder? IF so, the entry point RVA is inside the
' // .edata section, AND is an RVA TO the DllName.EntryPointName
IF (entryPointRVA >= exportsStartRVA) AND (entryPointRVA <= exportsEndRVA) THEN
' printf("%s\[email protected]%u", entryPointRVA - delta + pBase, i + @pExportDir.nBase)
sLen = wsprintf(pFunction, "%s\[email protected]%05u", BYVAL entryPointRVA - delta + pBase, BYVAL i + @pExportDir.nBase)
s = s + LEFT$(pFunction, slen) + $CRLF
flag = 1
END IF
END IF
NEXT
FUNCTION = 1
END FUNCTION
FUNCTION DumpExeFile(BYVAL hw_cmb AS LONG, dosHeader AS IMAGE_DOS_HEADER PTR ) AS LONG
DIM pNTHeader AS IMAGE_NT_HEADERS PTR
DIM pBase AS DWORD
pBase = dosHeader
pNTHeader = dosHeader + @dosHeader.e_lfanew
IF ( IsBadReadPtr(pNTHeader, SIZEOF(pNTHeader)) OR @pNTHeader.Signature <> %IMAGE_NT_SIGNATURE ) THEN
FUNCTION = 0
EXIT FUNCTION
END IF
FUNCTION = DumpExportsSection(pBase, hw_cmb, BYVAL pNTHeader)
END FUNCTION
FUNCTION EnumFunctions(fName AS ASCIIZ, BYVAL hw_cmb AS LONG) AS LONG
DIM hFile AS LONG
DIM hFileMapping AS LONG
DIM lpFileBase AS LONG
DIM dosHeader AS IMAGE_DOS_HEADER PTR
DIM pResult AS ASCIIZ * 5000
DIM pFormat AS LONG
hFile = CreateFile(fName, %GENERIC_READ, %FILE_SHARE_READ, BYVAL 0&, %OPEN_EXISTING, %FILE_ATTRIBUTE_NORMAL, 0)
IF hFile = %INVALID_HANDLE_VALUE THEN
FUNCTION = 0
EXIT FUNCTION
END IF
hFileMapping = CreateFileMapping(hFile, BYVAL 0&, %PAGE_READONLY, 0, 0, BYVAL 0&)
IF hFileMapping = 0 THEN
CALL CloseHandle(hFile)
FUNCTION = 0
EXIT FUNCTION
END IF
lpFileBase = MapViewOfFile(hFileMapping, %FILE_MAP_READ, 0, 0, 0)
IF lpFileBase = 0 THEN
CALL CloseHandle(hFileMapping)
CALL CloseHandle(hFile)
FUNCTION = 0
EXIT FUNCTION
END IF
dosHeader = lpFileBase
IF ( @dosHeader.e_magic = %IMAGE_DOS_SIGNATURE ) THEN
FUNCTION = DumpExeFile(hw_cmb, BYVAL dosHeader)
END IF
CALL UnmapViewOfFile(lpFileBase)
CALL CloseHandle(hFileMapping)
CALL CloseHandle(hFile)
END FUNCTION
Comment