How to get list of all imported functions invoked via GetProcAddress

Question

0.00/5 (No votes)

See more:

Hi,

I have a requirement to list all imported functions by parsing PE.
If an exe or dll implicitly links a dll (using import library), I can get all the invoked functions from import table. But if any dll or exe explicitly links a dll, then the import table will not have an entry for that dll which is linked explicitly.

Kindly let me know how to get the list of all external functions invoked when the dll is explicitly loaded.

Posted 1-Mar-12 18:28pm

Kiran Bharadwaj

Add a Solution

Comments

Richard MacCutchan 2-Mar-12 3:05am

Unless you can identify each point in the code where GetProcAddress() is invoked there is no way to do it.

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

nv3 · Answer 1 · 2012-03-02T01:21:00

The previous solution entry deals only with the libraries that are linked statically (you called it 'implicitly'). These can easily be found by looking at the PE file with the before mentioned tools.

But I understand that you also want a list of all libraries and functions that are loaded at runtime by calls to LoadLibrary and GetProcAddress. To my best knowledge there is no reliable way of finding those. For example, a program could compile the name of a library by concatenating several strings and then call LoadLibrary. In that case you won't even find the library name in the PE file. The only way of detecting these reference is to search the program for calls to LoadLibrary, then reverse engineer the code that constructs the library name, then analyze all GetProcAddress calls for that library in the same way. That can be as easy as looking up a string or as difficult as analyzing cryptographic code when the name is encoded in some secret way.

In summary: If a developer wants to hide, which libraries are being used at runtime, he can very well do that and you won't be able to find out by just statically analyzing the PE file.

Sergey Alexandrovich Kryukov · Answer 2 · 2012-03-01T19:07:00

You can get complete specification of PE here:
http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx[^].

You can find other documents in references to the Wikipedia article:
http://en.wikipedia.org/wiki/Portable_Executable[^].

This information is enough to make a list of entry names in exports as well as dependencies (explicitly imported DLLs and entry points).

This CodeProject article provides some description and source code for PE parsing, but some readers criticized this work for some problems and code quality. At least it could help you the get the idea of what's involved:
Parse a PE (EXE, DLL, OCX Files ) and New Dependency Walker[^].

Some parsing is also shown in this CodeProject article, but I don't see that it looks for exports or imports. Good to take a look, anyway:
XPEInfo - a non-MFC class to get info from PE file[^].

See also:
http://www.csn.ul.ie/~caolan/pub/winresdump/winresdump/doc/pefile2.html[^] — a very detailed article,
XPEInfo - a non-MFC class to get info from PE file[^].

—SA

How to get list of all imported functions invoked via GetProcAddress

2 solutions

Solution 2

Solution 1

Add your solution here

Preview 0