PureBasic Forums - English

Code: Select all

; Here it is how to enumerate the exported functions from a DLL using API and some pointer arithmetic instead of PB commands.
; Should work for Ascii/Unicode/x86/x64

; Why use this ? I don't know. 
; Maybe the ImageDirectoryEntryToData() usage example can be useful as a starting point for someone wanting to explore the PE file format.

EnableExplicit

#PBCODE = 1

#DLLNAME$ = "OPENGL32.DLL" ; also try "USER32.DLL"

CompilerIf #PBCODE = 1

Define hDLL

Debug "USING PB COMMANDS"

hDLL = OpenLibrary(#PB_Any, #DLLNAME$)

If hDLL
    Debug CountLibraryFunctions(hDLL)
    
    If ExamineLibraryFunctions(hDLL)
        While NextLibraryFunction()
            Debug LibraryFunctionName() + " = $" + Hex(LibraryFunctionAddress())
        Wend
    EndIf
    CloseLibrary(hDLL)
EndIf

CompilerElse

Define hDLL

Define *ied.IMAGE_EXPORT_DIRECTORY
Define NumberOfNames, size, i, ord
Define *AddressOfFunctions, *AddressOfNames, *AddressOfNameOrdinals
Define FunctionName$, *FunctionAddress 

Debug "USING API AND IMAGE_EXPORT_DIRECTORY STRUCTURE"

hDLL = LoadLibrary_(#DLLNAME$)

If hDLL
    *ied = ImageDirectoryEntryToData_(hDLL, 1, #IMAGE_DIRECTORY_ENTRY_EXPORT, @size)
    
    If *ied 
        NumberOfNames = *ied\NumberOfNames        
        
        Debug NumberOfNames
        
        *AddressOfFunctions = hDLL + *ied\AddressOfFunctions
        *AddressOfNames = hDLL + *ied\AddressOfNames
        *AddressOfNameOrdinals = hDLL + *ied\AddressOfNameOrdinals
        
        For i = 0 To NumberOfNames - 1            
            FunctionName$ = PeekS(hDLL + PeekL(*AddressOfNames + (i * SizeOf(Long))), -1, #PB_Ascii)
            ord = PeekU(*AddressOfNameOrdinals + (i * SizeOf(Word)))           
            *FunctionAddress = hDLL + PeekL(*AddressOfFunctions + (ord * SizeOf(Long)))
            Debug FunctionName$ + " = $" + Hex(*FunctionAddress)
        Next    
    EndIf
    FreeLibrary_(hDLL)
EndIf

CompilerEndIf

Code: Select all

Define hDLL
Define *ied.IMAGE_EXPORT_DIRECTORY
Define NumberOfNames, NumberOfFunctions, size, i, idx, OrdinalBase
Define *AddressOfFunctions, *AddressOfNames, *AddressOfNameOrdinals
Define FunctionName$, *FunctionAddress
Dim NamedExportIDX(0)

#DLLNAME$ = "user32.dll" 

hDLL = LoadLibrary_(#DLLNAME$)

If hDLL
    *ied = ImageDirectoryEntryToData_(hDLL, 1, #IMAGE_DIRECTORY_ENTRY_EXPORT, @size)
   
    If *ied       
        NumberOfNames = *ied\NumberOfNames       
        NumberOfFunctions = *ied\NumberOfFunctions         
        OrdinalBase = *ied\Base               

        Debug "NumberOfFunctions = " + NumberOfFunctions
        Debug "NumberOfNames = " + NumberOfNames
   
        ReDim NamedExportIDX(NumberOfFunctions - 1)
       
        *AddressOfFunctions = hDLL + *ied\AddressOfFunctions
        *AddressOfNames = hDLL + *ied\AddressOfNames
        *AddressOfNameOrdinals = hDLL + *ied\AddressOfNameOrdinals
        
        For i = 0 To NumberOfNames - 1 ; first pass to map the index for only the functions with a name            
            NamedExportIDX(PeekU(*AddressOfNameOrdinals + (i * SizeOf(Word)))) = i + 1
        Next   
        
        For i = 0 To NumberOfFunctions - 1
            FunctionName$ = "?" ; default unnamed
            If NamedExportIDX(i) ; if we saved the index for this entry, we know this has a name
                FunctionName$ = PeekS(hDLL + PeekL(*AddressOfNames + ((NamedExportIDX(i) - 1) * SizeOf(Long))), -1, #PB_Ascii)
            EndIf
            *FunctionAddress = hDLL + PeekL(*AddressOfFunctions + (i * SizeOf(Long)))
            Debug "["+ Str(OrdinalBase + i) + "] " + FunctionName$ + " = $" + Hex(*FunctionAddress)
        Next   
    EndIf
    FreeLibrary_(hDLL)
EndIf