DLLのエクスポートディレクトリ (ID:72527)

名前

ホームページ(ブログ、Twitterなど)のURL (省略可)

本文 少しおかしいところがあったので修正しました。 これでDependency Walkerとほぼ同じになりました。 void dump(HMODULE module) { TCHAR path[MAX_PATH]; ::GetModuleFileName(module, path, MAX_PATH); _tprintf(TEXT("dump %s\n"), path); HANDLE file = ::CreateFile(path, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0); HANDLE map = ::CreateFileMapping(file, NULL, PAGE_READONLY | SEC_IMAGE, 0, 0, NULL); LPVOID view = ::MapViewOfFile(map, FILE_MAP_READ, 0, 0, 0); IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)view; IMAGE_NT_HEADERS* nt = MAKE_PTR(IMAGE_NT_HEADERS*, dos, dos->e_lfanew); IMAGE_EXPORT_DIRECTORY* exportDirectory = MAKE_PTR(IMAGE_EXPORT_DIRECTORY*, dos, nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); DWORD* nameTable = MAKE_PTR(DWORD*, dos, exportDirectory->AddressOfNames); WORD* ordinalTable = MAKE_PTR(WORD*, dos, exportDirectory->AddressOfNameOrdinals); DWORD* addressTable = MAKE_PTR(DWORD*, dos, exportDirectory->AddressOfFunctions); for (DWORD i = 0; i < exportDirectory->NumberOfNames; i++) { LPCSTR name = MAKE_PTR(LPCSTR, dos, nameTable[i]); WORD ordinal = ordinalTable[i]; PROC proc = (PROC)addressTable[ordinal]; // 修正 printf("%3d, %3d, %08X, %s\n", i, ordinal + exportDirectory->Base, proc, name); // 修正 } ::UnmapViewOfFile(view); ::CloseHandle(map); ::CloseHandle(file); _tprintf(TEXT("\n")); } void main() { dump(::LoadLibrary(TEXT("kernel32.dll"))); dump(::LoadLibrary(TEXT("shell32.dll"))); }