DLLのエクスポートディレクトリ (ID:72525)

名前

ホームページ(ブログ、Twitterなど)のURL (省略可)

本文 CreateFileMapping() の SEC_IMAGE を利用すれば、LoadLibrary() でロードした場合と同じようにデータが配置されます。 void dump(HMODULE module) { TCHAR path[MAX_PATH]; ::GetModuleFileName(module, path, MAX_PATH); HANDLE file = ::CreateFile(path, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0); HANDLE map = ::CreateFileMapping(file, NULL, PAGE_READONLY | SEC_IMAGE, 0, 0, NULL); LPVOID view = ::MapViewOfFile(map, FILE_MAP_READ, 0, 0, 0); IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)view; IMAGE_NT_HEADERS* nt = MAKE_PTR(IMAGE_NT_HEADERS*, dos, dos->e_lfanew); IMAGE_EXPORT_DIRECTORY* exportDirectory = MAKE_PTR(IMAGE_EXPORT_DIRECTORY*, dos, nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); DWORD* nameTable = MAKE_PTR(DWORD*, dos, exportDirectory->AddressOfNames); WORD* ordinalTable = MAKE_PTR(WORD*, dos, exportDirectory->AddressOfNameOrdinals); DWORD* addressTable = MAKE_PTR(DWORD*, dos, exportDirectory->AddressOfFunctions); for (DWORD i = 0; i < exportDirectory->NumberOfNames; i++) { LPCSTR name = MAKE_PTR(LPCSTR, dos, nameTable[i]); WORD ordinal = ordinalTable[i]; PROC proc = (PROC)addressTable[i]; printf("%3d, %3d, %08X, %s\n", i, ordinal, proc, name); } ::UnmapViewOfFile(view); ::CloseHandle(map); ::CloseHandle(file); }