开发者

Viewing Contents Of a DLL File

开发者 https://www.devze.com 2023-01-11 14:36 出处:网络
is this possible to view contents and Functions of a DLL file... few times ago i was playing with OlyDBG then i found 开发者_开发问答there is option for viewing contents of dll...

is this possible to view contents and Functions of a DLL file...

few times ago i was playing with OlyDBG then i found 开发者_开发问答there is option for viewing contents of dll...

so suggest me any good tool or soft for this...

and suppose i have a DLL named "Python27.dll"...

now i need to view the content of this DLL so what do i do...

thanx...


While not trivial to use (you need to understand the format of a Portable Executable, aka PE, file), pefile seems a good, powerful and versatile tool for the purpose of viewing a DLL or any other PE file (I wouldn't risk using it to change such a file, although I see it's one of its features).

For example, excerpting the module's usage examples (and editing to show a dll instead of the equally hypothetical filename they use, which is an exe;-):

import pefile
pe =  pefile.PE(‘/path/to/pefile.dll’)
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
  print hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal

should, according to the wikipage I pointed to, display something like:

0x7ca0ab4f SHUpdateRecycleBinIcon 336
0x7cab44c0 SHValidateUNC 173
0x7ca7b0aa SheChangeDirA 337
0x7ca7b665 SheChangeDirExA 338
0x7ca7b3e1 SheChangeDirExW 339
0x7ca7aec6 SheChangeDirW 340
0x7ca8baae SheConvertPathW 341


Dependency Walker may provide what you want/need -- it certainly shows all the entry points in a DLL.


On Windows, DUMPBIN provides some DLL inspection capabilities. For example:

DUMPBIN /EXPORTS C:\path\to\my.dll

will display all the exported definitions.


I've done some work with ctypes, and loading dlls in windows, but I don't think DLL have any sort of introspection. This really isn't a big deal, because all of the function calls in DLLs are static. If your trying to use a undocumented DLL, you would not only need to know the names of the functions, but also the parameters of the functions. You would have to reverse engineer the DLL, no small task.

So, in my opinion, I would say no.

0

精彩评论

暂无评论...
验证码 换一张
取 消

关注公众号