-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
0 parents
commit d8edcd1
Showing
17 changed files
with
2,635 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
<?xml version="1.0" encoding="utf-8" ?> | ||
<configuration> | ||
<startup> | ||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" /> | ||
</startup> | ||
</configuration> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,212 @@ | ||
// | ||
// C# (.Net Framework) | ||
// dkxce.DllExportList | ||
// v 0.1, 17.07.2023 | ||
// dkxce (https://github.com/dkxce/DllExportList) | ||
// en,ru,1251,utf-8 | ||
// | ||
|
||
using System; | ||
using System.IO; | ||
using System.Text; | ||
|
||
namespace dkxce | ||
{ | ||
public struct DllExportList | ||
{ | ||
private static readonly Encoding DefaultEncoding = Encoding.ASCII; | ||
|
||
public struct ExportFunction | ||
{ | ||
/// <summary> | ||
/// Pointer To Function Name Null-Terminated String | ||
/// </summary> | ||
private uint NamePtr; | ||
|
||
/// <summary> | ||
/// Name of Exported Function | ||
/// </summary> | ||
public string Name; | ||
|
||
/// <summary> | ||
/// Entry Point of Exported Function | ||
/// </summary> | ||
public string EntryPoint; | ||
|
||
/// <summary> | ||
/// Ordinal of Exported Function | ||
/// </summary> | ||
public uint Ordinal; | ||
|
||
/// <summary> | ||
/// Pointer of Exported Function | ||
/// </summary> | ||
public uint Address; | ||
|
||
public override string ToString() | ||
{ | ||
return $"{Ordinal:D2} {Name}, hex: {EntryPoint}, dec: {Address}"; | ||
} | ||
|
||
internal static ExportFunction Create(uint NamePtr) | ||
{ | ||
ExportFunction res = new ExportFunction(); | ||
res.NamePtr = NamePtr; | ||
return res; | ||
} | ||
} | ||
|
||
/// <summary> | ||
/// Pointer To Module Name Null-Terminated String | ||
/// </summary> | ||
private uint ModuleNamePtr; | ||
|
||
/// <summary> | ||
/// DLL Module Name | ||
/// </summary> | ||
public string ModuleName; | ||
|
||
/// <summary> | ||
/// DLL Ordinal Base | ||
/// </summary> | ||
public uint OrdinalBase; | ||
|
||
/// <summary> | ||
/// DLL Exported Function Count | ||
/// </summary> | ||
public uint FunctionsCount; | ||
|
||
/// <summary> | ||
/// DLL Exported Function Names Count | ||
/// </summary> | ||
public uint NamesCount; | ||
|
||
/// <summary> | ||
/// Is x86 (32-bit) | ||
/// </summary> | ||
public bool x86; | ||
|
||
/// <summary> | ||
/// Is x64 (64-bit) | ||
/// </summary> | ||
public bool x64; | ||
|
||
public ExportFunction[] Functions; | ||
|
||
public static DllExportList GetDllExportFunctions(string fileName) | ||
{ | ||
const int DEF_SHORT_SIZE = 0x0002; | ||
const int DEF_INT_SIZE = 0x0004; | ||
const int PESignatureOffset = 0x003C; | ||
const int PESignatureSize = 0x0004; | ||
const int COFFHeaderSize = 0x0014; | ||
const int SectionHeaderSize = 0x0028; | ||
const int ARCHITECTURE_I386 = 0x014C; | ||
const int ARCHITECTURE_AMD64 = 0x8664; | ||
const int IMAGE_FILE_IS_DLL = 0x2000; | ||
const int IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x0020B; | ||
const string DEF_DLL_START = "MZ"; | ||
const string DEF_PES_START = "PE\0\0"; | ||
|
||
using (FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read)) | ||
{ | ||
if (fs.Length == 0) throw new IOException("DLL File is Empty"); | ||
|
||
byte[] RAWDATA = new byte[DEF_SHORT_SIZE]; fs.Read(RAWDATA, 0, RAWDATA.Length); | ||
if (DefaultEncoding.GetString(RAWDATA) != DEF_DLL_START) throw new IOException("DLL File Invalid, no MS-DOS stub"); | ||
|
||
fs.Position = PESignatureOffset; | ||
RAWDATA = new byte[DEF_INT_SIZE]; fs.Read(RAWDATA, 0, RAWDATA.Length); | ||
fs.Position = BitConverter.ToInt32(RAWDATA, 0); | ||
|
||
RAWDATA = new byte[PESignatureSize]; fs.Read(RAWDATA, 0, RAWDATA.Length); | ||
if (DefaultEncoding.GetString(RAWDATA) != DEF_PES_START) throw new IOException("PE Signature not found"); | ||
|
||
RAWDATA = new byte[COFFHeaderSize]; fs.Read(RAWDATA, 0, RAWDATA.Length); | ||
ushort Machine = BitConverter.ToUInt16(RAWDATA, 0); | ||
ushort NumberOfSections = BitConverter.ToUInt16(RAWDATA, 2); | ||
ushort SizeOfOptionalHeader = BitConverter.ToUInt16(RAWDATA, 16); | ||
ushort Characteristics = BitConverter.ToUInt16(RAWDATA, 18); | ||
if ((Machine != ARCHITECTURE_I386) && (Machine != ARCHITECTURE_AMD64)) throw new Exception($"CPU Type {Machine} Not Supported"); | ||
if ((Characteristics & IMAGE_FILE_IS_DLL) == 0) throw new Exception("Invalid DLL file"); | ||
|
||
RAWDATA = new byte[SizeOfOptionalHeader]; fs.Read(RAWDATA, 0, RAWDATA.Length); | ||
ushort btns = BitConverter.ToUInt16(RAWDATA, 0); | ||
int offset = (btns == IMAGE_NT_OPTIONAL_HDR64_MAGIC) ? 16 : 0; | ||
uint SizeOfImage = BitConverter.ToUInt32(RAWDATA, 56); | ||
|
||
offset += 92; | ||
uint NumberOfRvaAndSizes = BitConverter.ToUInt32(RAWDATA, offset + 0); | ||
uint ExportAddr = BitConverter.ToUInt32(RAWDATA, offset + 4); | ||
uint ExportSize = BitConverter.ToUInt32(RAWDATA, offset + 8); | ||
if (NumberOfRvaAndSizes < 1 /* the number of data directory entries */ || ExportAddr < 1 /* the address of the export table(RVA) */ || ExportSize < 1 /* the size of the export table */) | ||
throw new Exception("Couldn't find an Export table"); | ||
|
||
uint SectionsLength = (uint)(SectionHeaderSize * NumberOfSections); | ||
RAWDATA = new byte[SectionsLength]; fs.Read(RAWDATA, 0, RAWDATA.Length); | ||
byte[] ImageData = new byte[SizeOfImage]; | ||
|
||
int off = 0; | ||
for (int i = 0; i < NumberOfSections; i++) | ||
{ | ||
int VirtualAddress = BitConverter.ToInt32(RAWDATA, off + 12); | ||
int SizeOfRawData = BitConverter.ToInt32(RAWDATA, off + 16); | ||
int PointerToRawData = BitConverter.ToInt32(RAWDATA, off + 20); | ||
fs.Position = PointerToRawData; | ||
fs.Read(ImageData, VirtualAddress, SizeOfRawData); | ||
off += SectionHeaderSize; | ||
}; | ||
|
||
Func<byte[], int, string> BytesToStr = (byte[] bytes, int ofset) => | ||
{ | ||
string res = ""; | ||
int i = ofset; | ||
while (i < bytes.Length) | ||
{ | ||
byte b = bytes[i++]; | ||
if (b == 0) return res; | ||
res += (char)b; | ||
}; | ||
return res; | ||
}; | ||
|
||
uint EndOfSection = ExportAddr + ExportSize; | ||
|
||
DllExportList dlle = new DllExportList(); | ||
dlle.x86 = btns != IMAGE_NT_OPTIONAL_HDR64_MAGIC; | ||
dlle.x64 = btns == IMAGE_NT_OPTIONAL_HDR64_MAGIC; | ||
dlle.ModuleNamePtr = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 12); | ||
dlle.OrdinalBase = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 16); | ||
dlle.FunctionsCount = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 20); | ||
dlle.NamesCount = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 24); | ||
dlle.Functions = new DllExportList.ExportFunction[dlle.FunctionsCount]; | ||
|
||
uint FuncTblPtr = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 28); | ||
uint NameTblPtr = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 32); | ||
uint OrdTblPtr = BitConverter.ToUInt32(ImageData, (int)ExportAddr + 36); | ||
|
||
dlle.ModuleName = BytesToStr(ImageData, (int)dlle.ModuleNamePtr); | ||
|
||
for (int i = 0; i < dlle.FunctionsCount; i++) | ||
{ | ||
uint NamePtr = BitConverter.ToUInt32(ImageData, (int)NameTblPtr); | ||
dlle.Functions[i] = DllExportList.ExportFunction.Create(NamePtr); | ||
dlle.Functions[i].Ordinal = BitConverter.ToUInt16(ImageData, (int)OrdTblPtr); | ||
dlle.Functions[i].Address = BitConverter.ToUInt32(ImageData, (int)FuncTblPtr + ((int)dlle.Functions[i].Ordinal * 4)); | ||
dlle.Functions[i].Ordinal += dlle.OrdinalBase; | ||
dlle.Functions[i].EntryPoint = (dlle.Functions[i].Address > ExportAddr) && (dlle.Functions[i].Address < EndOfSection) ? BytesToStr(ImageData, (int)dlle.Functions[i].Address) : "0x" + dlle.Functions[i].Address.ToString("X8"); | ||
dlle.Functions[i].Name = BytesToStr(ImageData, (int)NamePtr); | ||
NameTblPtr += 4; | ||
OrdTblPtr += 2; | ||
}; | ||
|
||
return dlle; | ||
}; | ||
} | ||
|
||
public override string ToString() | ||
{ | ||
return $"{ModuleName} ({FunctionsCount} functions with {NamesCount} names from {OrdinalBase} ordinal base"; | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,91 @@ | ||
<?xml version="1.0" encoding="utf-8"?> | ||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" /> | ||
<PropertyGroup> | ||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration> | ||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform> | ||
<ProjectGuid>{AD4AFBE8-12E0-4A8C-972B-3C398142C75F}</ProjectGuid> | ||
<OutputType>WinExe</OutputType> | ||
<RootNamespace>DllExportList</RootNamespace> | ||
<AssemblyName>DllExportList</AssemblyName> | ||
<TargetFrameworkVersion>v4.8</TargetFrameworkVersion> | ||
<FileAlignment>512</FileAlignment> | ||
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects> | ||
<Deterministic>true</Deterministic> | ||
</PropertyGroup> | ||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' "> | ||
<PlatformTarget>AnyCPU</PlatformTarget> | ||
<DebugSymbols>true</DebugSymbols> | ||
<DebugType>full</DebugType> | ||
<Optimize>false</Optimize> | ||
<OutputPath>bin\Debug\</OutputPath> | ||
<DefineConstants>DEBUG;TRACE</DefineConstants> | ||
<ErrorReport>prompt</ErrorReport> | ||
<WarningLevel>4</WarningLevel> | ||
</PropertyGroup> | ||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' "> | ||
<PlatformTarget>AnyCPU</PlatformTarget> | ||
<DebugType>pdbonly</DebugType> | ||
<Optimize>true</Optimize> | ||
<OutputPath>bin\Release\</OutputPath> | ||
<DefineConstants>TRACE</DefineConstants> | ||
<ErrorReport>prompt</ErrorReport> | ||
<WarningLevel>4</WarningLevel> | ||
</PropertyGroup> | ||
<PropertyGroup> | ||
<ApplicationIcon>icon.ico</ApplicationIcon> | ||
</PropertyGroup> | ||
<ItemGroup> | ||
<Reference Include="System" /> | ||
<Reference Include="System.Core" /> | ||
<Reference Include="System.Xml.Linq" /> | ||
<Reference Include="System.Data.DataSetExtensions" /> | ||
<Reference Include="Microsoft.CSharp" /> | ||
<Reference Include="System.Data" /> | ||
<Reference Include="System.Deployment" /> | ||
<Reference Include="System.Drawing" /> | ||
<Reference Include="System.Net.Http" /> | ||
<Reference Include="System.Windows.Forms" /> | ||
<Reference Include="System.Xml" /> | ||
</ItemGroup> | ||
<ItemGroup> | ||
<Compile Include="DLLExportList.cs" /> | ||
<Compile Include="Form1.cs"> | ||
<SubType>Form</SubType> | ||
</Compile> | ||
<Compile Include="Form1.Designer.cs"> | ||
<DependentUpon>Form1.cs</DependentUpon> | ||
</Compile> | ||
<Compile Include="Program.cs" /> | ||
<Compile Include="Properties\AssemblyInfo.cs" /> | ||
<Compile Include="XMLSaved.cs" /> | ||
<EmbeddedResource Include="Form1.resx"> | ||
<DependentUpon>Form1.cs</DependentUpon> | ||
</EmbeddedResource> | ||
<EmbeddedResource Include="Properties\Resources.resx"> | ||
<Generator>ResXFileCodeGenerator</Generator> | ||
<LastGenOutput>Resources.Designer.cs</LastGenOutput> | ||
<SubType>Designer</SubType> | ||
</EmbeddedResource> | ||
<Compile Include="Properties\Resources.Designer.cs"> | ||
<AutoGen>True</AutoGen> | ||
<DependentUpon>Resources.resx</DependentUpon> | ||
</Compile> | ||
<None Include="Properties\Settings.settings"> | ||
<Generator>SettingsSingleFileGenerator</Generator> | ||
<LastGenOutput>Settings.Designer.cs</LastGenOutput> | ||
</None> | ||
<Compile Include="Properties\Settings.Designer.cs"> | ||
<AutoGen>True</AutoGen> | ||
<DependentUpon>Settings.settings</DependentUpon> | ||
<DesignTimeSharedInput>True</DesignTimeSharedInput> | ||
</Compile> | ||
</ItemGroup> | ||
<ItemGroup> | ||
<None Include="App.config" /> | ||
</ItemGroup> | ||
<ItemGroup> | ||
<Content Include="icon.ico" /> | ||
</ItemGroup> | ||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" /> | ||
</Project> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
|
||
Microsoft Visual Studio Solution File, Format Version 12.00 | ||
# Visual Studio Version 17 | ||
VisualStudioVersion = 17.5.33530.505 | ||
MinimumVisualStudioVersion = 10.0.40219.1 | ||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DllExportList", "DllExportList.csproj", "{AD4AFBE8-12E0-4A8C-972B-3C398142C75F}" | ||
EndProject | ||
Global | ||
GlobalSection(SolutionConfigurationPlatforms) = preSolution | ||
Debug|Any CPU = Debug|Any CPU | ||
Release|Any CPU = Release|Any CPU | ||
EndGlobalSection | ||
GlobalSection(ProjectConfigurationPlatforms) = postSolution | ||
{AD4AFBE8-12E0-4A8C-972B-3C398142C75F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU | ||
{AD4AFBE8-12E0-4A8C-972B-3C398142C75F}.Debug|Any CPU.Build.0 = Debug|Any CPU | ||
{AD4AFBE8-12E0-4A8C-972B-3C398142C75F}.Release|Any CPU.ActiveCfg = Release|Any CPU | ||
{AD4AFBE8-12E0-4A8C-972B-3C398142C75F}.Release|Any CPU.Build.0 = Release|Any CPU | ||
EndGlobalSection | ||
GlobalSection(SolutionProperties) = preSolution | ||
HideSolutionNode = FALSE | ||
EndGlobalSection | ||
GlobalSection(ExtensibilityGlobals) = postSolution | ||
SolutionGuid = {8EEFF80B-447E-4D2B-9657-CAD99C91878F} | ||
EndGlobalSection | ||
EndGlobal |
Oops, something went wrong.