C# - 로딩된 Native DLL의 export 함수 목록 출력

마침 지난 글에서 정리한 PE 헤더를 다루는 코드도 있으니,

해당 DLL이 Managed인지 / Unmanaged인지 확인하는 방법 - 두 번째 이야기
; https://www.sysnet.pe.kr/2/0/1296

(또는, nuget에서 설치 가능한 Workshell.PE를 사용해도 됩니다.)

public unsafe ExportFunctionInfo[] GetExportFunctions()
{
    if (_baseAddress == IntPtr.Zero)
    {
        return null;
    }

    if (Export.VirtualAddress == 0)
    {
        return null;
    }

    IntPtr exportDir = IntPtr.Add(_baseAddress, (int)Export.VirtualAddress);
    IMAGE_EXPORT_DIRECTORY dir = (IMAGE_EXPORT_DIRECTORY)Marshal.PtrToStructure(exportDir, typeof(IMAGE_EXPORT_DIRECTORY));

    IntPtr nameListPtr = IntPtr.Add(_baseAddress, (int)dir.AddressOfNames);
    UnmanagedMemoryStream ums = new UnmanagedMemoryStream((byte*)nameListPtr.ToPointer(), dir.NumberOfNames * sizeof(int));
    BinaryReader br = new BinaryReader(ums);

    List<ExportFunctionInfo> list = new List<ExportFunctionInfo>();

    for (int i = 0; i < dir.NumberOfNames; i++)
    {
        int namePos = br.ReadInt32();
        int nameRawPtr = namePos;
        IntPtr namePtr = IntPtr.Add(_baseAddress, nameRawPtr);

        ExportFunctionInfo efi = new ExportFunctionInfo();
        efi.Name = Marshal.PtrToStringAnsi(namePtr);
        efi.NameOrdinal = GetOrdinalFromExport(dir.AddressOfNameOrdinals, dir.NumberOfNames, i);
        efi.RvaAddress = GetRvaAddressFromExport(dir.AddressOfFunctions, dir.NumberOfFunctions, efi.NameOrdinal);
        efi.Ordinal = efi.NameOrdinal + dir.Base;

        list.Add(efi);
    }

    return list.ToArray();
}

static void Main(string[] args)
{
    Process currentProcess = Process.GetCurrentProcess();
    foreach (ProcessModule pm in currentProcess.Modules)
    {
        Console.WriteLine($"[{pm.FileName}, 0x{pm.BaseAddress.ToString("x")}]");

        PEImage pe = PEImage.ReadFromMemory(pm.BaseAddress, pm.ModuleMemorySize);
        if (pe == null)
        {
            Console.WriteLine("Failed to read images");
            return;
        }

        foreach (ExportFunctionInfo efi in pe.EnumerateExportFunctions().Take(5))
        {
            Console.WriteLine("\t" + efi);
        }

        Console.WriteLine("\t...");

        Console.WriteLine();
    }
}

[C:\temp\ConsoleApplication1\ConsoleApplication1\bin\Debug\ConsoleApplication1.exe, 0x490000]
.text: 0x2000 ~ 0x2d8c
.rsrc: 0x4000 ~ 0x45fc
.reloc: 0x6000 ~ 0x600c

        ...

[C:\WINDOWS\SYSTEM32\ntdll.dll, 0x7ffdba800000]
.text: 0x1000 ~ 0x116446
RT: 0x117000 ~ 0x1171f9
.rdata: 0x118000 ~ 0x15ec40
.data: 0x15f000 ~ 0x16a330
.pdata: 0x16b000 ~ 0x179094
.mrdata: 0x17a000 ~ 0x17d4f0
.00cfg: 0x17e000 ~ 0x17e008
.rsrc: 0x17f000 ~ 0x1ee310
.reloc: 0x1ef000 ~ 0x1ef528

        A_SHAFinal at 0xc4d0
        A_SHAInit at 0xc600
        A_SHAUpdate at 0xc640
        AlpcAdjustCompletionListConcurrencyCount at 0xdfc40
        AlpcFreeCompletionListMessage at 0x6bf50
        ...

[C:\WINDOWS\SYSTEM32\MSCOREE.DLL, 0x7ffdabf60000]
.text: 0x1000 ~ 0x3f794
.rdata: 0x40000 ~ 0x576e0
.data: 0x58000 ~ 0x5d184
.pdata: 0x5e000 ~ 0x60850
.didat: 0x61000 ~ 0x610e8
.rsrc: 0x62000 ~ 0x62748
.reloc: 0x63000 ~ 0x63d94

        CLRCreateInstance at 0xa980
        CallFunctionShim at 0x6970
        CloseCtrs at 0x8850
        ClrCreateManagedInstance at 0x51d0
        CoEEShutDownCOM at 0x50c0
        ...

[C:\WINDOWS\System32\KERNEL32.dll, 0x7ffdb89f0000]
.text: 0x1000 ~ 0x75750
.rdata: 0x76000 ~ 0xa76f4
.data: 0xa8000 ~ 0xa915c
.pdata: 0xaa000 ~ 0xaf430
.rsrc: 0xb0000 ~ 0xb0520
.reloc: 0xb1000 ~ 0xb124c

        AcquireSRWLockExclusive at 0x92c6f
        AcquireSRWLockShared at 0x92ca5
        ActivateActCtx at 0x1e640
        ActivateActCtxWorker at 0x1a950
        AddAtomA at 0x21650
        ...

[C:\WINDOWS\System32\KERNELBASE.dll, 0x7ffdb7d30000]
.text: 0x1000 ~ 0x10530b
.rdata: 0x106000 ~ 0x2671fe
.data: 0x268000 ~ 0x26c38c
.pdata: 0x26d000 ~ 0x27b214
.didat: 0x27c000 ~ 0x27c680
.rsrc: 0x27d000 ~ 0x27d548
.reloc: 0x27e000 ~ 0x2a25e4

        AccessCheck at 0x68600
        AccessCheckAndAuditAlarmW at 0x703d0
        AccessCheckByType at 0x68690
        AccessCheckByTypeAndAuditAlarmW at 0xf2830
        AccessCheckByTypeResultList at 0xf2970
        ...

[C:\WINDOWS\System32\ADVAPI32.dll, 0x7ffdb94a0000]
.text: 0x1000 ~ 0x5f3e0
.rdata: 0x60000 ~ 0x94b74
.data: 0x95000 ~ 0x993c2
.pdata: 0x9a000 ~ 0x9e2f0
.didat: 0x9f000 ~ 0x9f460
.rsrc: 0xa0000 ~ 0xa05c8
.reloc: 0xa1000 ~ 0xa2818

        A_SHAFinal at 0x8a628
        A_SHAInit at 0x8a643
        A_SHAUpdate at 0x8a65f
        AbortSystemShutdownA at 0x3d570
        AbortSystemShutdownW at 0x3d5f0
        ...

[C:\WINDOWS\System32\msvcrt.dll, 0x7ffdb9550000]
.text: 0x1000 ~ 0x75a91
.rdata: 0x76000 ~ 0x8ebf0
.data: 0x8f000 ~ 0x96b80
.pdata: 0x97000 ~ 0x9b65c
.rsrc: 0x9c000 ~ 0x9c3f0
.reloc: 0x9d000 ~ 0x9d4a4

        ??0__non_rtti_object@@QEAA@AEBV0@@Z at 0xa540
        ??0__non_rtti_object@@QEAA@PEBD@Z at 0xa570
        ??0bad_cast@@AAE@PBQBD@Z at 0xa5a0
        ??0bad_cast@@AEAA@PEBQEBD@Z at 0xa5a0
        ??0bad_cast@@QAE@ABQBD@Z at 0xa5a0
        ...

[C:\WINDOWS\System32\sechost.dll, 0x7ffdb8bd0000]
.text: 0x1000 ~ 0x612f0
.rdata: 0x62000 ~ 0x884ba
.data: 0x89000 ~ 0x8c6e8
.pdata: 0x8d000 ~ 0x91314
.didat: 0x92000 ~ 0x92120
.rsrc: 0x93000 ~ 0x942b8
.reloc: 0x95000 ~ 0x96384

        AuditComputeEffectivePolicyBySid at 0x1a220
        AuditEnumerateCategories at 0x4c2a0
        AuditEnumeratePerUserPolicy at 0x4c3c0
        AuditEnumerateSubCategories at 0x4c430
        AuditFree at 0x33c0
        ...

[C:\WINDOWS\System32\RPCRT4.dll, 0x7ffdb8ab0000]
.text: 0x1000 ~ 0xd5e01
.ndr64: 0xd6000 ~ 0xdd1d3
.rdata: 0xde000 ~ 0x10815c
.data: 0x109000 ~ 0x10a4d8
.pdata: 0x10b000 ~ 0x117210
.didat: 0x118000 ~ 0x118288
.rsrc: 0x119000 ~ 0x11d560
.reloc: 0x11e000 ~ 0x11f79c

        CStdStubBuffer_AddRef at 0x5a1f0
        CStdStubBuffer_Connect at 0xc6400
        CStdStubBuffer_CountRefs at 0xc6460
        CStdStubBuffer_DebugServerQueryInterface at 0xc64b0
        CStdStubBuffer_DebugServerRelease at 0xc6510
        ...

[C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll, 0x7ffdab420000]
.text: 0x1000 ~ 0x6d9a8
.rdata: 0x6e000 ~ 0x9bfb4
.data: 0x9c000 ~ 0x9f02a
.pdata: 0xa0000 ~ 0xa5c04
.didat: 0xa6000 ~ 0xa6138
.rsrc: 0xa7000 ~ 0xa77c0
.reloc: 0xa8000 ~ 0xa8cd8

        CLRCreateInstance at 0xd960
        CallFunctionShim at 0x29940
        CloseCtrs at 0x2b750
        ClrCreateManagedInstance at 0x290f0
        CoEEShutDownCOM at 0x29270
        ...

[C:\WINDOWS\System32\SHLWAPI.dll, 0x7ffdb9b70000]
.text: 0x1000 ~ 0x2a30c
.rdata: 0x2b000 ~ 0x4a406
.data: 0x4b000 ~ 0x4bed0
.pdata: 0x4c000 ~ 0x4e490
.didat: 0x4f000 ~ 0x4f6f0
.rsrc: 0x50000 ~ 0x50d98
.reloc: 0x51000 ~ 0x51698

        AssocCreate at 0x6330
        AssocGetPerceivedType at 0x3880
        AssocIsDangerous at 0x14100
        AssocQueryKeyA at 0x14830
        AssocQueryKeyW at 0x6160
        ...

[C:\WINDOWS\System32\combase.dll, 0x7ffdb9730000]
.text: 0x1000 ~ 0x21a25d
.proxy: 0x21b000 ~ 0x21fb7c
.rdata: 0x220000 ~ 0x2e21c6
.data: 0x2e3000 ~ 0x2e8e0c
.pdata: 0x2e9000 ~ 0x312700
.didat: 0x313000 ~ 0x3135d0
.rsrc: 0x314000 ~ 0x3274c8
.reloc: 0x328000 ~ 0x3356dc

        CLIPFORMAT_UserFree at 0x1cb170
        CLIPFORMAT_UserFree64 at 0xd7b60
        CLIPFORMAT_UserMarshal at 0x1cb5f0
        CLIPFORMAT_UserMarshal64 at 0xb7b10
        CLIPFORMAT_UserSize at 0x1cb740
        ...

[C:\WINDOWS\System32\ucrtbase.dll, 0x7ffdb7990000]
.text: 0x1000 ~ 0xb1af0
.rdata: 0xb2000 ~ 0xe9498
.data: 0xea000 ~ 0xec4b4
.pdata: 0xed000 ~ 0xf7fc8
.rsrc: 0xf8000 ~ 0xf8410
.reloc: 0xf9000 ~ 0xf9a94

        _Cbuild at 0x87e60
        _Cmulcc at 0x87ae0
        _Cmulcr at 0x87b30
        _CreateFrameInfo at 0x3b480
        _CxxThrowException at 0x3b640
        ...

[C:\WINDOWS\System32\bcryptPrimitives.dll, 0x7ffdb8830000]
.text: 0x1000 ~ 0x66dd5
.rdata: 0x67000 ~ 0x79bba
.data: 0x7a000 ~ 0x7a938
.pdata: 0x7b000 ~ 0x7de20
.rsrc: 0x7e000 ~ 0x7e448
.reloc: 0x7f000 ~ 0x7f468

        GetAsymmetricEncryptionInterface at 0x21200
        GetCipherInterface at 0x11a10
        GetHashInterface at 0x46c0
        GetKeyDerivationInterface at 0x24370
        GetRngInterface at 0x21700
        ...

[C:\WINDOWS\System32\GDI32.dll, 0x7ffdb9bd0000]
.text: 0x1000 ~ 0xcbf3
.rdata: 0xd000 ~ 0x1fb02
.data: 0x20000 ~ 0x20778
.pdata: 0x21000 ~ 0x21bd0
.didat: 0x22000 ~ 0x23458
.rsrc: 0x24000 ~ 0x243d8
.reloc: 0x25000 ~ 0x25540

        AbortDoc at 0xb110
        AbortPath at 0x6c90
        AddFontMemResourceEx at 0x5c20
        AddFontResourceA at 0xb130
        AddFontResourceExA at 0x6d30
        ...

[C:\WINDOWS\System32\win32u.dll, 0x7ffdb7960000]
.text: 0x1000 ~ 0xad82
.rdata: 0xb000 ~ 0x192a0
.data: 0x1a000 ~ 0x1a580
.pdata: 0x1b000 ~ 0x1eb04
.rsrc: 0x1f000 ~ 0x1f3d8
.reloc: 0x20000 ~ 0x20014

        NtBindCompositionSurface at 0x32d0
        NtCloseCompositionInputSink at 0x32f0
        NtCompositionInputThread at 0x3310
        NtCompositionSetDropTarget at 0x3330
        NtConfigureInputSpace at 0x3350
        ...

[C:\WINDOWS\System32\gdi32full.dll, 0x7ffdb77c0000]
.text: 0x1000 ~ 0xd09b5
.rdata: 0xd1000 ~ 0x171d12
.data: 0x172000 ~ 0x176200
.pdata: 0x177000 ~ 0x17ec50
.didat: 0x17f000 ~ 0x17f048
.rsrc: 0x180000 ~ 0x1919c8
.reloc: 0x192000 ~ 0x193cac

        AbortDocImpl at 0x70e50
        AbortPath at 0x74340
        AddFontMemResourceEx at 0x613a0
        AddFontResourceA at 0x613f0
        AddFontResourceExA at 0x61400
        ...

[C:\WINDOWS\System32\msvcp_win.dll, 0x7ffdb7c90000]
.text: 0x1000 ~ 0x54d22
.rdata: 0x55000 ~ 0x91d54
.data: 0x92000 ~ 0x957e0
.pdata: 0x96000 ~ 0x9ac50
.didat: 0x9b000 ~ 0x9b040
.rsrc: 0x9c000 ~ 0x9c410
.reloc: 0x9d000 ~ 0x9d7e0

        ??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z at 0x2a550
        ??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z at 0x2a550
        ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z at 0x2a550
        ??0?$_Yarn@D@std@@QEAA@AEBV01@@Z at 0x46440
        ??0?$_Yarn@D@std@@QEAA@PEBD@Z at 0x227d0
        ...

[C:\WINDOWS\System32\USER32.dll, 0x7ffdb9df0000]
.text: 0x1000 ~ 0x8645d
.rdata: 0x87000 ~ 0xa6ec8
.data: 0xa7000 ~ 0xa8b0e
.pdata: 0xa9000 ~ 0xafd08
.didat: 0xb0000 ~ 0xb00f0
.rsrc: 0xb1000 ~ 0x1921a0
.reloc: 0x193000 ~ 0x193414

        ActivateKeyboardLayout at 0x2b6d0
        AddClipboardFormatListener at 0x2bda0
        AddVisualIdentifier at 0x324f0
        AdjustWindowRect at 0x7cfb0
        AdjustWindowRectEx at 0x191f0
        ...

[C:\WINDOWS\System32\IMM32.DLL, 0x7ffdb9c60000]
.text: 0x1000 ~ 0x1c96b
.rdata: 0x1d000 ~ 0x23016
.data: 0x24000 ~ 0x24f48
.pdata: 0x25000 ~ 0x26230
.didat: 0x27000 ~ 0x271f8
.rsrc: 0x28000 ~ 0x2cc40
.reloc: 0x2d000 ~ 0x2d0d8

        CtfImmAppCompatEnableIMEonProtectedCode at 0x1c390
        CtfImmCoUninitialize at 0x4ee0
        CtfImmDispatchDefImeMessage at 0x4560
        CtfImmEnterCoInitCountSkipMode at 0x1c3b0
        CtfImmGenerateMessage at 0x100a0
        ...

[C:\WINDOWS\System32\kernel.appcore.dll, 0x7ffdb7700000]
.text: 0x1000 ~ 0x4d27
.rdata: 0x5000 ~ 0xbd70
.data: 0xc000 ~ 0xc5d8
.pdata: 0xd000 ~ 0xd4e0
.didat: 0xe000 ~ 0xe018
.rsrc: 0xf000 ~ 0xf410
.reloc: 0x10000 ~ 0x10088

        AcquireStateLock at 0x2ef0
        AddExtensionProgId at 0x2f00
        AddPackageToFamilyXref at 0x2f10
        AppContainerDeriveSidFromMoniker at 0x2f20
        AppContainerFreeMemory at 0x2f30
        ...

[C:\WINDOWS\SYSTEM32\VERSION.dll, 0x7ffdb1ec0000]
.text: 0x1000 ~ 0x35a0
.rdata: 0x4000 ~ 0x5b74
.data: 0x6000 ~ 0x6614
.pdata: 0x7000 ~ 0x72c4
.rsrc: 0x8000 ~ 0x8428
.reloc: 0x9000 ~ 0x901c

        GetFileVersionInfoA at 0x1080
        GetFileVersionInfoByHandle at 0x2190
        GetFileVersionInfoExA at 0x1df0
        GetFileVersionInfoExW at 0x1040
        GetFileVersionInfoSizeA at 0x1010
        ...

[C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll, 0x7ffda92f0000]
.text: 0x1000 ~ 0x7c3310
.rdata: 0x7c4000 ~ 0xa17554
.data: 0xa18000 ~ 0xa3aa54
.pdata: 0xa3b000 ~ 0xab5d30
.didat: 0xab6000 ~ 0xab65a0
.tls: 0xab7000 ~ 0xab7015
.rsrc: 0xab8000 ~ 0xab8920
.reloc: 0xab9000 ~ 0xac6fcc

        AttachProfiler at 0x465f30
        CertCreateAuthenticodeLicense at 0x21ee90
        CertFreeAuthenticodeSignerInfo at 0x21ebf0
        CertFreeAuthenticodeTimestamperInfo at 0x21ebb0
        CertTimestampAuthenticodeLicense at 0x21ecb0
        ...

[C:\WINDOWS\SYSTEM32\VCRUNTIME140_CLR0400.dll, 0x7ffda9070000]
.text: 0x1000 ~ 0xd4d7
.rdata: 0xe000 ~ 0x114d0
.data: 0x12000 ~ 0x12978
.pdata: 0x13000 ~ 0x1381c
.rsrc: 0x14000 ~ 0x14428
.reloc: 0x15000 ~ 0x15164

        _CreateFrameInfo at 0xbbb0
        _CxxThrowException at 0x4430
        _FindAndUnlinkFrame at 0xbc50
        _IsExceptionObjectToBeDestroyed at 0xbc10
        _SetWinRTOutOfMemoryExceptionCallback at 0x2440
        ...

[C:\WINDOWS\SYSTEM32\ucrtbase_clr0400.dll, 0x7ffda90a0000]
.text: 0x1000 ~ 0x8ab40
.rdata: 0x8b000 ~ 0xb1ff4
.data: 0xb2000 ~ 0xb4158
.pdata: 0xb5000 ~ 0xbaa78
.rsrc: 0xbb000 ~ 0xbb418
.reloc: 0xbc000 ~ 0xbcaac

        _Cbuild at 0x1d00
        _Cmulcc at 0x1dd0
        _Cmulcr at 0x1eb0
        _Exit at 0x14b0
        _FCbuild at 0x1540
        ...

[C:\WINDOWS\System32\psapi.dll, 0x7ffdb89e0000]
.text: 0x1000 ~ 0x1467
.rdata: 0x2000 ~ 0x30f8
.data: 0x4000 ~ 0x4580
.pdata: 0x5000 ~ 0x503c
.rsrc: 0x6000 ~ 0x63e0
.reloc: 0x7000 ~ 0x7018

        EmptyWorkingSet at 0x1340
        EnumDeviceDrivers at 0x1050
        EnumPageFilesA at 0x1350
        EnumPageFilesW at 0x1360
        EnumProcessModules at 0x1010
        ...

[C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\ce65e35ae3e57af12f3515300d00e518\mscorlib.ni.dll, 0x7ffd97720000]
.data: 0x1000 ~ 0x539a30
.text: 0x53a000 ~ 0x1576539
.reloc: 0x1577000 ~ 0x15ff574

        ...

[C:\WINDOWS\System32\ole32.dll, 0x7ffdb9c90000]
.text: 0x1000 ~ 0xc7e29
.proxy: 0xc8000 ~ 0xc983c
.rdata: 0xca000 ~ 0x126132
.data: 0x127000 ~ 0x128f10
.pdata: 0x129000 ~ 0x137718
.didat: 0x138000 ~ 0x1382f0
.rsrc: 0x139000 ~ 0x14e240
.reloc: 0x14f000 ~ 0x1551e4

        BindMoniker at 0x3e620
        CLIPFORMAT_UserFree at 0x11a2b1
        CLIPFORMAT_UserFree64 at 0x11a2e3
        CLIPFORMAT_UserFreeExt at 0x52520
        CLIPFORMAT_UserMarshal at 0x11a318
        ...

[C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll, 0x7ffda6310000]
.text: 0x1000 ~ 0x114744
.rdata: 0x115000 ~ 0x12e160
.data: 0x12f000 ~ 0x1311b8
.pdata: 0x132000 ~ 0x14bdf4
.tls: 0x14c000 ~ 0x14c011
.rsrc: 0x14d000 ~ 0x14d468
.reloc: 0x14e000 ~ 0x14e4f4

        getJit at 0x91480
        jitStartup at 0x923f0
        sxsJitStartup at 0x914f0
        ...

[C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\9803982d7bc887e2745bff18a434ece1\System.ni.dll, 0x7ffd7a3c0000]
.data: 0x1000 ~ 0x2a4520
.text: 0x2a5000 ~ 0xc3295b
.reloc: 0xc33000 ~ 0xc6fc54

        ...

[C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\54311e67e34cb0c9f0d74b123f759d8d\System.Core.ni.dll, 0x7ffd791b0000]
.data: 0x1000 ~ 0x33c1d0
.text: 0x33d000 ~ 0xa16828
.reloc: 0xa17000 ~ 0xa747d8

        ...