1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:

{
Visit the author's page at http://assarbad.net
Author : -=Assarbad=-
License: no warranties, no restrictions, PUBLIC DOMAIN
}
program listforwarders;
{$APPTYPE CONSOLE}
uses
  Windows,
  ImageHlp;

type
  TWordArr = array[0..0] of Word;
  PWordArr = ^TWordArr;
  TDWordArr = array[0..0] of DWORD;
  PDWordArr = ^TDWordArr;

procedure ShowForwarders(filename: string);
var
  li: LoadedImage;
  dwEntry,
    dwExportsRVA_end,
    dwExportsRVA,
    dwExportsSize: DWORD;
  lpHeader: PImageSectionHeader;
  lpExportDir: PImageExportDirectory;
  lpFuncs: PDWORD;
  pwOrdinals: PWordArr;
  lpFuncNames: PDWordArr;
  szTemp, szTemp1, szTemp2: PChar;
  i, j: Integer;
begin
  if MapAndLoad(@filename[1], nil, @li, False, True) then
  try
    if (li.Characteristics and IMAGE_FILE_DLL <> 0) and not (li.fSystemImage) then
    try
      dwExportsRVA := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
      dwExportsSize := li.FileHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
      dwExportsRVA_end := dwExportsRVA + dwExportsSize;
      lpExportDir := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwExportsRVA, lpHeader);
      szTemp1 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpExportDir^.Name, lpHeader);
      lpFuncs := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfFunctions), lpHeader);
      pwOrdinals := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNameOrdinals), lpHeader);
      lpFuncNames := ImageRvaToVa(li.FileHeader, li.MappedAddress, DWORD(lpExportDir^.AddressOfNames), lpHeader);
      for i := 0 to lpExportDir^.NumberOfFunctions - 1 do
      begin
        dwEntry := PDWORD(lpfuncs)^;
        if dwEntry = 0 then
          continue;
        if (dwEntry >= dwExportsRVA) and (dwEntry <= dwExportsRVA_end) then
        begin
          szTemp := ImageRvaToVa(li.FileHeader, li.MappedAddress, dwEntry, lpHeader);
          for j := 0 to lpExportDir^.NumberOfNames - 1 do
            if pwOrdinals[j] = i then
            begin
              szTemp2 := ImageRvaToVa(li.FileHeader, li.MappedAddress, lpFuncNames^[j], lpHeader);
              Write('[',string(szTemp1),']',string(szTemp2));
            end;
          Writeln(' -> ', string(szTemp));
        end;
        inc(lpFuncs);
      end;
    finally
    end;
  finally
    UnMapAndLoad(@li);
  end;
end;

begin
  if paramstr(1)<>'' then
  ShowForwarders(paramstr(1));
end.					

1:
2:
3:
4:
5:
6:
7:

@echo off
rem Visit the author's page at http://assarbad.net
rem Author : -=Assarbad=-
rem License: no warranties, no restrictions, PUBLIC DOMAIN
for /f "tokens=*" %%i in ('dir /b /s *.dll') do (
  listforwarders "%%i"
)