CODEWITHSUNDEEP
c++cportable-executable
Kiran Kumar R
Kiran Kumar R

Reputation: 1

Listing imported functions from a PE file if dll is linked explicitly using LoadLibrary

I have a requirement to list all imported functions by parsing PE. If an exe or dll implicitly links a dll (using import library), I can get all the invoked functions from import table. But if any dll or exe explicitly links a dll (using LoadLibrary and getProcAddress), then the import table will not have an entry for that dll which is linked explicitly.

Kindly let me know how to get the list of all external functions invoked (using getProcAddress) when the dll is explicitly loaded.

Thanks and Regards, Kiran

Upvotes: 0

Views: 1150

Answers (1)

Jerry Coffin
Jerry Coffin

Reputation: 490108

There is no way that's 100% dependable. Basically, you can set something up to monitor what parameters are passed to LoadLibrary and GetProcAddress while it's running to see what you find -- but you need to be aware that choices made by the user during execution can and will affect what shows up.

It can also change based on things like the contents of configuration files, files that are found an in arbitrary directory, etc. (e.g., loading all the DLLs in directory X, and invoking initialize_plugin() in each).

Upvotes: 1

Related Questions