C++ 有没有办法找到一个dll公开的所有函数

Is there a way to find all the functions exposed by a dll

提问by minty

I've been searching for a way to get all the strings that map to function names in a dll.

我一直在寻找一种方法来获取映射到 dll 中函数名称的所有字符串。

I mean by this all the strings for which you can call GetProcAddress. If you do a hex dump of a dll the symbols (strings) are there but I figure there must me a system call to acquire those names.

我的意思是您可以调用 GetProcAddress 的所有字符串。如果你对 dll 进行十六进制转储，符号（字符串）就在那里，但我认为必须有一个系统调用来获取这些名称。

采纳答案by Aaron

It takes a bit of work, but you can do this programmaticly using the DbgHelplibrary from Microsoft.

这需要一些工作，但您可以使用Microsoft的DbgHelp库以编程方式执行此操作。

Debugging Applications for Microsoft .Net and Microsoft Windows, by John Robbinsis an excellent (if a little older) book which contains use details and full source. And, you can pick it up on Amazon for the cheap!

调试 Microsoft .Net 和 Microsoft Windows 的应用程序，John Robbins是一本优秀的（如果有点旧）书，其中包含使用详细信息和完整源代码。而且，你可以在亚马逊上以便宜的价格买到它！

回答by Die in Sente

If you have MS Visual Studio, there is a command line tool called DUMPBIN.

如果您有 MS Visual Studio，则有一个名为 DUMPBIN 的命令行工具。

dumpbin /exports <nameofdll>

回答by Mike Thompson

There are three distinct types of DLLs under Windows:

Windows 下有三种不同类型的 DLL：

1. Classic DLLs that expose every available function in the exports table of the DLL. You can use dumpbin.exe or depends.exe from Visual Studio, or the free dependency walkerto examine these types. Matt Pietrek wrote many articles and utilities for digging into Win32 PE files. Have a look at his classic MSDN Magazine articles. C++ DLLs that contain exported classes will export every method in the class. Unfortunately it exports the mangled names, so the output of dumpbin is virtually unreadable. You will need to use a program like vc++_filt.exe to demangle the output.

2. COM DLLs that expose COM objects. These DLLs expose a handful of regular exported functions (DllRegisterServer etc) that enable the COM system to instantiate objects. There are many utilities that can look at these DLLs, but unless they have embedded type libraries they can be quite difficult to examine. 4Developershave a number of good COM/ActiveX tools

3. .NET DLLs that contain .NET assemblies. Typiically you would use a tool like .NET Reflectorto dig into these.

1. 公开 DLL 导出表中每个可用函数的经典 DLL。您可以使用 Visual Studio 中的 dumpbin.exe 或depends.exe 或免费的依赖项walker来检查这些类型。Matt Pietrek 撰写了许多文章和实用程序来深入研究 Win32 PE 文件。看看他的经典MSDN 杂志文章。包含导出类的 C++ DLL 将导出类中的每个方法。不幸的是，它导出了损坏的名称，因此 dumpbin 的输出实际上是不可读的。您将需要使用像 vc++_filt.exe 这样的程序来对输出进行解码。

2. 公开 COM 对象的 COM DLL。这些 DLL 公开了一些常规导出函数（DllRegisterServer 等），使 COM 系统能够实例化对象。有许多实用程序可以查看这些 DLL，但除非它们具有嵌入式类型库，否则很难对其进行检查。4开发者有很多不错的COM/ActiveX工具

3. 包含 .NET 程序集的 .NET DLL。通常，您会使用.NET Reflector 之类的工具来深入研究这些。

Edit: 4Developers link is not working.

编辑：4Developers 链接不起作用。

回答by Die in Sente

Also there is the DEPENDs program at http://www.dependencywalker.com/

还有http://www.dependencywalker.com/ 上的 DEPENDs 程序

回答by Robert Larsen

Try this (Linux) C code:

试试这个 (Linux) C 代码：

#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

unsigned int vpe2offset(void * base, unsigned int vpe) {
    unsigned int * ptr = base;
    unsigned int pe_offset;
    unsigned short num_sections;

    pe_offset = ptr[0x3c/4];                             //PE header offset
    ptr = base + pe_offset;                              //PE header address
    num_sections = ((unsigned short*)ptr)[6/2];          //Section count
    ptr = ((void*)base) + 0x18 + 0x60 + 16*8 + pe_offset;//Address of first section

    while (num_sections--) {
        if (vpe >= ptr[0x0c/4] && vpe < ptr[0x0c/4] + ptr[0x10/4]) {
            return vpe - ptr[0x0c/4] + ptr[0x14/4];
        }
        ptr += 0x28/4;
    }

    return 0;
}

void iterate_exports(void * base, int(*iterator)(char*)) {
    unsigned int * ptr = base;
    unsigned int pe_offset,
                 exports_offset,
                 number_of_names,
                 address_of_names;

    pe_offset = ptr[0x3c/4];
    ptr = base + pe_offset;
    exports_offset = ptr[0x78/4];
    ptr = base + vpe2offset(base, exports_offset);
    number_of_names = ptr[0x18/4];
    address_of_names = ptr[0x20/4];
    ptr = base + vpe2offset(base, address_of_names);
    while (number_of_names-- && iterator((char*)(base + vpe2offset(base, ptr++[0])))) {
        /* Do nothing */
    }
}

int print_symbol_name(char * name) {
    printf("%s\n", name);
    return 1;
}

int main(int argc, char const *argv[]) {
    int fd;
    struct stat st;
    void * base;

    if (argc == 1) {
        printf("Usage: %s <dll>\n", argv[0]);
    } else if (stat(argv[1], &st) == 0 && (fd = open(argv[1], O_RDONLY)) >= 0) {
        base = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (base != MAP_FAILED) {
            iterate_exports(base, print_symbol_name);
            munmap(base, st.st_size);
        } else {
            fprintf(stderr, "Could not map \"%s\".\n", argv[1]);
        }
        close(fd);
    } else {
        fprintf(stderr, "Could not open \"%s\" for reading.\n", argv[1]);
    }
    return 0;
}

It follows references inside the PE file and finally calls a callback function for each exported symbol. For an overview of the PE file format see this: http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf

它遵循 PE 文件中的引用，最后为每个导出的符号调用回调函数。有关 PE 文件格式的概述，请参见：http: //www.openrce.org/reference_library/files/reference/PE%20Format.pdf

回答by ChrisW

I don't know of a WIn32 API to do it: instead, you (or one of the tools mentioned in other posts) do it by knowing the binary format of a PE file, and reading the file: see http://msdn.microsoft.com/en-us/magazine/cc301808.aspx(and that article mentioned a "PEDUMP" utility).

我不知道有 WIn32 API 可以做到这一点：相反，您（或其他帖子中提到的工具之一）通过了解 PE 文件的二进制格式并阅读文件来做到这一点：请参阅http://msdn .microsoft.com/en-us/magazine/cc301808.aspx（该文章提到了“PEDUMP”实用程序）。

回答by ctacke

I use dumpbinGUI, which gives you the list of exports (and a lot more) from a right click in Windows Explorer. dumpbinand dependswill both give you the lists as well.

我使用dumpbinGUI，它可以通过在 Windows 资源管理器中单击鼠标右键为您提供导出列表（以及更多）。dumpbin并且depends都会给你列表。

回答by MSN

You need to inspect the PE header of the .dll, since that's ultimately what Windows does anyways.

您需要检查 .dll 的 PE 标头，因为无论如何 Windows 最终都会这样做。

Assuming you have a pointer to the .dll's IMAGE_OPTIONAL_HEADER(you can either use dbghelp's ImageNtHeaderfunction with a handle to a .dll loaded via LoadLibraryor attempt to find it yourself if you know the layout of the .dll yourself), you'll want to look at optional_header->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT], find the export table relative to the optional header with the offset in there, then walk the export table (it's a IMAGE_EXPORT_DIRECTORY).

假设你有一个指向 .dll 的指针IMAGE_OPTIONAL_HEADER（你可以使用 dbghelp 的ImageNtHeader函数和通过加载的 .dll 的句柄，LoadLibrary或者如果你自己知道 .dll 的布局，你可以尝试自己找到它），你会想看看optional_header->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]，找到相对于可选标头的导出表，并在其中找到偏移量，然后遍历导出表（它是一个IMAGE_EXPORT_DIRECTORY）。

For funsies, a backwards compatible PE image starts out with a IMAGE_DOS_HEADER; the offset to the IMAGE_NT_HEADERis IMAGE_DOS_HEADER::e_lfanew, and the IMAGE_OPTIONAL_HEADERis embedded in the NT header.

对于 funsies，向后兼容的 PE 映像以IMAGE_DOS_HEADER;开头。的偏移量IMAGE_NT_HEADER是IMAGE_DOS_HEADER::e_lfanew，并且IMAGE_OPTIONAL_HEADER嵌入在 NT 标头中。

回答by MSN

there is a program called dll export viewer you can use: http://www.nirsoft.net/utils/dll_export_viewer.html

您可以使用一个名为 dll 导出查看器的程序：http: //www.nirsoft.net/utils/dll_export_viewer.html

回答by claws

I always have to do this. I just go to one of these sites. They host the information we usually need.

我总是不得不这样做。我只是去这些网站之一。他们托管我们通常需要的信息。

Windows 7 DLL File Information

Windows 7 DLL 文件信息

Windows XP DLL File Information

Windows XP DLL 文件信息