1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33: 34: 35: 36: 37: 38: 39: 40: 41: 42: 43: 44: 45: 46: 47: 48: 49: 50: 51: 52: 53: 54: 55: 56: 57: 58: 59: 60: 61: 62: 63: 64: 65: 66: 67: 68: 69: 70: 71: 72: 73:
| program listforwarders; {$APPTYPE CONSOLE} uses Windows, ImageHlp;
type TWordArr = array[0..0] of Word; PWordArr = ^TWordArr; TDWordArr = array[0..0] of DWORD; PDWordArr = ^TDWordArr;
procedure ShowForwarders(filename: string); var li: LoadedImage; dwEntry, dwExportsRVA_end, dwExportsRVA, dwExportsSize: DWORD; lpHeader: PImageSectionHeader; lpExportDir: PImageExportDirectory; lpFuncs: PDWORD; pwOrdinals: PWordArr; lpFuncNames: PDWordArr; szTemp, szTemp1, szTemp2: PChar; i, j: Integer; begin if MapAndLoad(@filename[1], nil, @li, False, True) then try if (li.Characteristics and IMAGE_FILE_DLL <> 0) and not (li.fSystemImage) then try dwExportsRVA := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress; dwExportsSize := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size; dwExportsRVA_end := dwExportsRVA + dwExportsSize; lpExportDir := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwExportsRVA, lpHeader); szTemp1 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpExportDir^.Name, lpHeader); lpFuncs := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfFunctions), lpHeader); pwOrdinals := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNameOrdinals), lpHeader); lpFuncNames := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNames), lpHeader); for i := 0 to lpExportDir^.NumberOfFunctions - 1 do begin dwEntry := PDWORD(lpfuncs)^; if dwEntry = 0 then continue; if (dwEntry >= dwExportsRVA) and (dwEntry <= dwExportsRVA_end) then begin szTemp := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwEntry, lpHeader); for j := 0 to lpExportDir^.NumberOfNames - 1 do if pwOrdinals[j] = i then begin szTemp2 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpFuncNames^[j], lpHeader); Write('[',string(szTemp1),']',string(szTemp2)); end; Writeln(' -> ', string(szTemp)); end; inc(lpFuncs); end; finally end; finally UnMapAndLoad(@li); end; end;
begin if paramstr(1)<>'' then ShowForwarders(paramstr(1)); end. |