I’ve been searching for a way to get all the strings that map to function names in a dll.
I mean by this all the strings for which you can call GetProcAddress. If you do a hex dump of a dll the symbols (strings) are there but I figure there must me a system call to acquire those names.
just a nitpick, but I think you meant > but I figure there must be a system call
If you are looking for a way to do it programmaticly, see my answer further down.
Also keep in mind that DLLs can export functions that don't have string names, and must be accessed via their ordinal.
Data can also be exported by ordinal. In both cases, though, it is still possible to use
GetProcAddress (...)using a name. You just have to use the pseudo-name that
MAKEINTRESOURCEA (<ordinal>)gives you; you are never going to find that name by walking the export table of the executable image, but
GetProcAddressknows full well what to do with it 😉
If you have MS Visual Studio, there is a command line tool called DUMPBIN.
Also there is the DEPENDs program at http://www.dependencywalker.com/
You need to inspect the PE header of the .dll, since that’s ultimately what Windows does anyways.
Assuming you have a pointer to the .dll’s
IMAGE_OPTIONAL_HEADER(you can either use dbghelp’s
ImageNtHeaderfunction with a handle to a .dll loaded via
LoadLibraryor attempt to find it yourself if you know the layout of the .dll yourself), you’ll want to look at
optional_header->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT], find the export table relative to the optional header with the offset in there, then walk the export table (it’s a
For funsies, a backwards compatible PE image starts out with a
IMAGE_DOS_HEADER; the offset to the
IMAGE_DOS_HEADER::e_lfanew, and the
IMAGE_OPTIONAL_HEADERis embedded in the NT header.
I use dumpbinGUI, which gives you the list of exports (and a lot more) from a right click in Windows Explorer.
dependswill both give you the lists as well.
I don’t know of a WIn32 API to do it: instead, you (or one of the tools mentioned in other posts) do it by knowing the binary format of a PE file, and reading the file: see http://msdn.microsoft.com/en-us/magazine/cc301808.aspx (and that article mentioned a “PEDUMP” utility).
I guess you will end up parsing PE file and do demangling yourself if you want to find the function names of an unknown dll in the runtime or extremely useless system(“dumpbin”); magic.
You should be more clear about what you want.
BFD library does what you want (and the kitchen sink) which is the main component of several GNU binutils tools. I can’t be sure if it will fit your problem.
there is a program called dll export viewer you can use: http://www.nirsoft.net/utils/dll_export_viewer.html
There are three distinct types of DLLs under Windows:
Classic DLLs that expose every available function in the exports table of the DLL. You can use dumpbin.exe or depends.exe from Visual Studio, or the free dependency walker to examine these types. Matt Pietrek wrote many articles and utilities for digging into Win32 PE files. Have a look at his classic MSDN Magazine articles. C++ DLLs that contain exported classes will export every method in the class. Unfortunately it exports the mangled names, so the output of dumpbin is virtually unreadable. You will need to use a program like vc++_filt.exe to demangle the output.
COM DLLs that expose COM objects. These DLLs expose a handful of regular exported functions (DllRegisterServer etc) that enable the COM system to instantiate objects. There are many utilities that can look at these DLLs, but unless they have embedded type libraries they can be quite difficult to examine.
4Developers have a number of good COM/ActiveX tools
.NET DLLs that contain .NET assemblies. Typiically you would use a tool like .NET Reflector to dig into these.
Edit: 4Developers link is not working.
You don’t need any tool and you don’t need to parse PE.
Just use standard Win32 api (D)
The code (in C) has been published many times on Adv.Win32 api ng (
news://comp.os.ms-windows.programmer.win32) (since 1992…)
You can also use the “objdump” linux tool under windows, but you may have to install cygwin first.
I use the following commands:
I always have to do this. I just go to one of these sites. They host the information we usually need.
Windows 7 DLL File Information
Windows XP DLL File Information
It takes a bit of work, but you can do this programmaticly using the DbgHelp library from Microsoft.
Debugging Applications for Microsoft .Net and Microsoft Windows, by John Robbins is an excellent (if a little older) book which contains use details and full source. And, you can pick it up on Amazon for the cheap!
Try this (Linux) C code:
It follows references inside the PE file and finally calls a callback function for each exported symbol. For an overview of the PE file format see this: http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf