C# - 로딩된 Native DLL의 export 함수 목록 출력
마침 지난 글에서 정리한 PE 헤더를 다루는 코드도 있으니,
해당 DLL이 Managed인지 / Unmanaged인지 확인하는 방법 - 두 번째 이야기
; https://www.sysnet.pe.kr/2/0/1296
(또는, nuget에서 설치 가능한 Workshell.PE를 사용해도 됩니다.)
간단하게 export 함수 목록을 구하는 코드를 작성할 수 있습니다.
public unsafe ExportFunctionInfo[] GetExportFunctions()
{
if (_baseAddress == IntPtr.Zero)
{
return null;
}
if (Export.VirtualAddress == 0)
{
return null;
}
IntPtr exportDir = IntPtr.Add(_baseAddress, (int)Export.VirtualAddress);
IMAGE_EXPORT_DIRECTORY dir = (IMAGE_EXPORT_DIRECTORY)Marshal.PtrToStructure(exportDir, typeof(IMAGE_EXPORT_DIRECTORY));
IntPtr nameListPtr = IntPtr.Add(_baseAddress, (int)dir.AddressOfNames);
UnmanagedMemoryStream ums = new UnmanagedMemoryStream((byte*)nameListPtr.ToPointer(), dir.NumberOfNames * sizeof(int));
BinaryReader br = new BinaryReader(ums);
List<ExportFunctionInfo> list = new List<ExportFunctionInfo>();
for (int i = 0; i < dir.NumberOfNames; i++)
{
int namePos = br.ReadInt32();
int nameRawPtr = namePos;
IntPtr namePtr = IntPtr.Add(_baseAddress, nameRawPtr);
ExportFunctionInfo efi = new ExportFunctionInfo();
efi.Name = Marshal.PtrToStringAnsi(namePtr);
efi.NameOrdinal = GetOrdinalFromExport(dir.AddressOfNameOrdinals, dir.NumberOfNames, i);
efi.RvaAddress = GetRvaAddressFromExport(dir.AddressOfFunctions, dir.NumberOfFunctions, efi.NameOrdinal);
efi.Ordinal = efi.NameOrdinal + dir.Base;
list.Add(efi);
}
return list.ToArray();
}
위와 같이 기능을 확장했으면, 이제 프로그램에서 다음과 같이 코드를 사용해 현재 로딩된 DLL들의 export 함수를 가져올 수 있습니다.
static void Main(string[] args)
{
Process currentProcess = Process.GetCurrentProcess();
foreach (ProcessModule pm in currentProcess.Modules)
{
Console.WriteLine($"[{pm.FileName}, 0x{pm.BaseAddress.ToString("x")}]");
PEImage pe = PEImage.ReadFromMemory(pm.BaseAddress, pm.ModuleMemorySize);
if (pe == null)
{
Console.WriteLine("Failed to read images");
return;
}
foreach (ExportFunctionInfo efi in pe.EnumerateExportFunctions().Take(5))
{
Console.WriteLine("\t" + efi);
}
Console.WriteLine("\t...");
Console.WriteLine();
}
}
다음은 출력 결과입니다.
[C:\temp\ConsoleApplication1\ConsoleApplication1\bin\Debug\ConsoleApplication1.exe, 0x490000]
.text: 0x2000 ~ 0x2d8c
.rsrc: 0x4000 ~ 0x45fc
.reloc: 0x6000 ~ 0x600c
...
[C:\WINDOWS\SYSTEM32\ntdll.dll, 0x7ffdba800000]
.text: 0x1000 ~ 0x116446
RT: 0x117000 ~ 0x1171f9
.rdata: 0x118000 ~ 0x15ec40
.data: 0x15f000 ~ 0x16a330
.pdata: 0x16b000 ~ 0x179094
.mrdata: 0x17a000 ~ 0x17d4f0
.00cfg: 0x17e000 ~ 0x17e008
.rsrc: 0x17f000 ~ 0x1ee310
.reloc: 0x1ef000 ~ 0x1ef528
A_SHAFinal at 0xc4d0
A_SHAInit at 0xc600
A_SHAUpdate at 0xc640
AlpcAdjustCompletionListConcurrencyCount at 0xdfc40
AlpcFreeCompletionListMessage at 0x6bf50
...
[C:\WINDOWS\SYSTEM32\MSCOREE.DLL, 0x7ffdabf60000]
.text: 0x1000 ~ 0x3f794
.rdata: 0x40000 ~ 0x576e0
.data: 0x58000 ~ 0x5d184
.pdata: 0x5e000 ~ 0x60850
.didat: 0x61000 ~ 0x610e8
.rsrc: 0x62000 ~ 0x62748
.reloc: 0x63000 ~ 0x63d94
CLRCreateInstance at 0xa980
CallFunctionShim at 0x6970
CloseCtrs at 0x8850
ClrCreateManagedInstance at 0x51d0
CoEEShutDownCOM at 0x50c0
...
[C:\WINDOWS\System32\KERNEL32.dll, 0x7ffdb89f0000]
.text: 0x1000 ~ 0x75750
.rdata: 0x76000 ~ 0xa76f4
.data: 0xa8000 ~ 0xa915c
.pdata: 0xaa000 ~ 0xaf430
.rsrc: 0xb0000 ~ 0xb0520
.reloc: 0xb1000 ~ 0xb124c
AcquireSRWLockExclusive at 0x92c6f
AcquireSRWLockShared at 0x92ca5
ActivateActCtx at 0x1e640
ActivateActCtxWorker at 0x1a950
AddAtomA at 0x21650
...
[C:\WINDOWS\System32\KERNELBASE.dll, 0x7ffdb7d30000]
.text: 0x1000 ~ 0x10530b
.rdata: 0x106000 ~ 0x2671fe
.data: 0x268000 ~ 0x26c38c
.pdata: 0x26d000 ~ 0x27b214
.didat: 0x27c000 ~ 0x27c680
.rsrc: 0x27d000 ~ 0x27d548
.reloc: 0x27e000 ~ 0x2a25e4
AccessCheck at 0x68600
AccessCheckAndAuditAlarmW at 0x703d0
AccessCheckByType at 0x68690
AccessCheckByTypeAndAuditAlarmW at 0xf2830
AccessCheckByTypeResultList at 0xf2970
...
[C:\WINDOWS\System32\ADVAPI32.dll, 0x7ffdb94a0000]
.text: 0x1000 ~ 0x5f3e0
.rdata: 0x60000 ~ 0x94b74
.data: 0x95000 ~ 0x993c2
.pdata: 0x9a000 ~ 0x9e2f0
.didat: 0x9f000 ~ 0x9f460
.rsrc: 0xa0000 ~ 0xa05c8
.reloc: 0xa1000 ~ 0xa2818
A_SHAFinal at 0x8a628
A_SHAInit at 0x8a643
A_SHAUpdate at 0x8a65f
AbortSystemShutdownA at 0x3d570
AbortSystemShutdownW at 0x3d5f0
...
[C:\WINDOWS\System32\msvcrt.dll, 0x7ffdb9550000]
.text: 0x1000 ~ 0x75a91
.rdata: 0x76000 ~ 0x8ebf0
.data: 0x8f000 ~ 0x96b80
.pdata: 0x97000 ~ 0x9b65c
.rsrc: 0x9c000 ~ 0x9c3f0
.reloc: 0x9d000 ~ 0x9d4a4
??0__non_rtti_object@@QEAA@AEBV0@@Z at 0xa540
??0__non_rtti_object@@QEAA@PEBD@Z at 0xa570
??0bad_cast@@AAE@PBQBD@Z at 0xa5a0
??0bad_cast@@AEAA@PEBQEBD@Z at 0xa5a0
??0bad_cast@@QAE@ABQBD@Z at 0xa5a0
...
[C:\WINDOWS\System32\sechost.dll, 0x7ffdb8bd0000]
.text: 0x1000 ~ 0x612f0
.rdata: 0x62000 ~ 0x884ba
.data: 0x89000 ~ 0x8c6e8
.pdata: 0x8d000 ~ 0x91314
.didat: 0x92000 ~ 0x92120
.rsrc: 0x93000 ~ 0x942b8
.reloc: 0x95000 ~ 0x96384
AuditComputeEffectivePolicyBySid at 0x1a220
AuditEnumerateCategories at 0x4c2a0
AuditEnumeratePerUserPolicy at 0x4c3c0
AuditEnumerateSubCategories at 0x4c430
AuditFree at 0x33c0
...
[C:\WINDOWS\System32\RPCRT4.dll, 0x7ffdb8ab0000]
.text: 0x1000 ~ 0xd5e01
.ndr64: 0xd6000 ~ 0xdd1d3
.rdata: 0xde000 ~ 0x10815c
.data: 0x109000 ~ 0x10a4d8
.pdata: 0x10b000 ~ 0x117210
.didat: 0x118000 ~ 0x118288
.rsrc: 0x119000 ~ 0x11d560
.reloc: 0x11e000 ~ 0x11f79c
CStdStubBuffer_AddRef at 0x5a1f0
CStdStubBuffer_Connect at 0xc6400
CStdStubBuffer_CountRefs at 0xc6460
CStdStubBuffer_DebugServerQueryInterface at 0xc64b0
CStdStubBuffer_DebugServerRelease at 0xc6510
...
[C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll, 0x7ffdab420000]
.text: 0x1000 ~ 0x6d9a8
.rdata: 0x6e000 ~ 0x9bfb4
.data: 0x9c000 ~ 0x9f02a
.pdata: 0xa0000 ~ 0xa5c04
.didat: 0xa6000 ~ 0xa6138
.rsrc: 0xa7000 ~ 0xa77c0
.reloc: 0xa8000 ~ 0xa8cd8
CLRCreateInstance at 0xd960
CallFunctionShim at 0x29940
CloseCtrs at 0x2b750
ClrCreateManagedInstance at 0x290f0
CoEEShutDownCOM at 0x29270
...
[C:\WINDOWS\System32\SHLWAPI.dll, 0x7ffdb9b70000]
.text: 0x1000 ~ 0x2a30c
.rdata: 0x2b000 ~ 0x4a406
.data: 0x4b000 ~ 0x4bed0
.pdata: 0x4c000 ~ 0x4e490
.didat: 0x4f000 ~ 0x4f6f0
.rsrc: 0x50000 ~ 0x50d98
.reloc: 0x51000 ~ 0x51698
AssocCreate at 0x6330
AssocGetPerceivedType at 0x3880
AssocIsDangerous at 0x14100
AssocQueryKeyA at 0x14830
AssocQueryKeyW at 0x6160
...
[C:\WINDOWS\System32\combase.dll, 0x7ffdb9730000]
.text: 0x1000 ~ 0x21a25d
.proxy: 0x21b000 ~ 0x21fb7c
.rdata: 0x220000 ~ 0x2e21c6
.data: 0x2e3000 ~ 0x2e8e0c
.pdata: 0x2e9000 ~ 0x312700
.didat: 0x313000 ~ 0x3135d0
.rsrc: 0x314000 ~ 0x3274c8
.reloc: 0x328000 ~ 0x3356dc
CLIPFORMAT_UserFree at 0x1cb170
CLIPFORMAT_UserFree64 at 0xd7b60
CLIPFORMAT_UserMarshal at 0x1cb5f0
CLIPFORMAT_UserMarshal64 at 0xb7b10
CLIPFORMAT_UserSize at 0x1cb740
...
[C:\WINDOWS\System32\ucrtbase.dll, 0x7ffdb7990000]
.text: 0x1000 ~ 0xb1af0
.rdata: 0xb2000 ~ 0xe9498
.data: 0xea000 ~ 0xec4b4
.pdata: 0xed000 ~ 0xf7fc8
.rsrc: 0xf8000 ~ 0xf8410
.reloc: 0xf9000 ~ 0xf9a94
_Cbuild at 0x87e60
_Cmulcc at 0x87ae0
_Cmulcr at 0x87b30
_CreateFrameInfo at 0x3b480
_CxxThrowException at 0x3b640
...
[C:\WINDOWS\System32\bcryptPrimitives.dll, 0x7ffdb8830000]
.text: 0x1000 ~ 0x66dd5
.rdata: 0x67000 ~ 0x79bba
.data: 0x7a000 ~ 0x7a938
.pdata: 0x7b000 ~ 0x7de20
.rsrc: 0x7e000 ~ 0x7e448
.reloc: 0x7f000 ~ 0x7f468
GetAsymmetricEncryptionInterface at 0x21200
GetCipherInterface at 0x11a10
GetHashInterface at 0x46c0
GetKeyDerivationInterface at 0x24370
GetRngInterface at 0x21700
...
[C:\WINDOWS\System32\GDI32.dll, 0x7ffdb9bd0000]
.text: 0x1000 ~ 0xcbf3
.rdata: 0xd000 ~ 0x1fb02
.data: 0x20000 ~ 0x20778
.pdata: 0x21000 ~ 0x21bd0
.didat: 0x22000 ~ 0x23458
.rsrc: 0x24000 ~ 0x243d8
.reloc: 0x25000 ~ 0x25540
AbortDoc at 0xb110
AbortPath at 0x6c90
AddFontMemResourceEx at 0x5c20
AddFontResourceA at 0xb130
AddFontResourceExA at 0x6d30
...
[C:\WINDOWS\System32\win32u.dll, 0x7ffdb7960000]
.text: 0x1000 ~ 0xad82
.rdata: 0xb000 ~ 0x192a0
.data: 0x1a000 ~ 0x1a580
.pdata: 0x1b000 ~ 0x1eb04
.rsrc: 0x1f000 ~ 0x1f3d8
.reloc: 0x20000 ~ 0x20014
NtBindCompositionSurface at 0x32d0
NtCloseCompositionInputSink at 0x32f0
NtCompositionInputThread at 0x3310
NtCompositionSetDropTarget at 0x3330
NtConfigureInputSpace at 0x3350
...
[C:\WINDOWS\System32\gdi32full.dll, 0x7ffdb77c0000]
.text: 0x1000 ~ 0xd09b5
.rdata: 0xd1000 ~ 0x171d12
.data: 0x172000 ~ 0x176200
.pdata: 0x177000 ~ 0x17ec50
.didat: 0x17f000 ~ 0x17f048
.rsrc: 0x180000 ~ 0x1919c8
.reloc: 0x192000 ~ 0x193cac
AbortDocImpl at 0x70e50
AbortPath at 0x74340
AddFontMemResourceEx at 0x613a0
AddFontResourceA at 0x613f0
AddFontResourceExA at 0x61400
...
[C:\WINDOWS\System32\msvcp_win.dll, 0x7ffdb7c90000]
.text: 0x1000 ~ 0x54d22
.rdata: 0x55000 ~ 0x91d54
.data: 0x92000 ~ 0x957e0
.pdata: 0x96000 ~ 0x9ac50
.didat: 0x9b000 ~ 0x9b040
.rsrc: 0x9c000 ~ 0x9c410
.reloc: 0x9d000 ~ 0x9d7e0
??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z at 0x2a550
??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z at 0x2a550
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z at 0x2a550
??0?$_Yarn@D@std@@QEAA@AEBV01@@Z at 0x46440
??0?$_Yarn@D@std@@QEAA@PEBD@Z at 0x227d0
...
[C:\WINDOWS\System32\USER32.dll, 0x7ffdb9df0000]
.text: 0x1000 ~ 0x8645d
.rdata: 0x87000 ~ 0xa6ec8
.data: 0xa7000 ~ 0xa8b0e
.pdata: 0xa9000 ~ 0xafd08
.didat: 0xb0000 ~ 0xb00f0
.rsrc: 0xb1000 ~ 0x1921a0
.reloc: 0x193000 ~ 0x193414
ActivateKeyboardLayout at 0x2b6d0
AddClipboardFormatListener at 0x2bda0
AddVisualIdentifier at 0x324f0
AdjustWindowRect at 0x7cfb0
AdjustWindowRectEx at 0x191f0
...
[C:\WINDOWS\System32\IMM32.DLL, 0x7ffdb9c60000]
.text: 0x1000 ~ 0x1c96b
.rdata: 0x1d000 ~ 0x23016
.data: 0x24000 ~ 0x24f48
.pdata: 0x25000 ~ 0x26230
.didat: 0x27000 ~ 0x271f8
.rsrc: 0x28000 ~ 0x2cc40
.reloc: 0x2d000 ~ 0x2d0d8
CtfImmAppCompatEnableIMEonProtectedCode at 0x1c390
CtfImmCoUninitialize at 0x4ee0
CtfImmDispatchDefImeMessage at 0x4560
CtfImmEnterCoInitCountSkipMode at 0x1c3b0
CtfImmGenerateMessage at 0x100a0
...
[C:\WINDOWS\System32\kernel.appcore.dll, 0x7ffdb7700000]
.text: 0x1000 ~ 0x4d27
.rdata: 0x5000 ~ 0xbd70
.data: 0xc000 ~ 0xc5d8
.pdata: 0xd000 ~ 0xd4e0
.didat: 0xe000 ~ 0xe018
.rsrc: 0xf000 ~ 0xf410
.reloc: 0x10000 ~ 0x10088
AcquireStateLock at 0x2ef0
AddExtensionProgId at 0x2f00
AddPackageToFamilyXref at 0x2f10
AppContainerDeriveSidFromMoniker at 0x2f20
AppContainerFreeMemory at 0x2f30
...
[C:\WINDOWS\SYSTEM32\VERSION.dll, 0x7ffdb1ec0000]
.text: 0x1000 ~ 0x35a0
.rdata: 0x4000 ~ 0x5b74
.data: 0x6000 ~ 0x6614
.pdata: 0x7000 ~ 0x72c4
.rsrc: 0x8000 ~ 0x8428
.reloc: 0x9000 ~ 0x901c
GetFileVersionInfoA at 0x1080
GetFileVersionInfoByHandle at 0x2190
GetFileVersionInfoExA at 0x1df0
GetFileVersionInfoExW at 0x1040
GetFileVersionInfoSizeA at 0x1010
...
[C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll, 0x7ffda92f0000]
.text: 0x1000 ~ 0x7c3310
.rdata: 0x7c4000 ~ 0xa17554
.data: 0xa18000 ~ 0xa3aa54
.pdata: 0xa3b000 ~ 0xab5d30
.didat: 0xab6000 ~ 0xab65a0
.tls: 0xab7000 ~ 0xab7015
.rsrc: 0xab8000 ~ 0xab8920
.reloc: 0xab9000 ~ 0xac6fcc
AttachProfiler at 0x465f30
CertCreateAuthenticodeLicense at 0x21ee90
CertFreeAuthenticodeSignerInfo at 0x21ebf0
CertFreeAuthenticodeTimestamperInfo at 0x21ebb0
CertTimestampAuthenticodeLicense at 0x21ecb0
...
[C:\WINDOWS\SYSTEM32\VCRUNTIME140_CLR0400.dll, 0x7ffda9070000]
.text: 0x1000 ~ 0xd4d7
.rdata: 0xe000 ~ 0x114d0
.data: 0x12000 ~ 0x12978
.pdata: 0x13000 ~ 0x1381c
.rsrc: 0x14000 ~ 0x14428
.reloc: 0x15000 ~ 0x15164
_CreateFrameInfo at 0xbbb0
_CxxThrowException at 0x4430
_FindAndUnlinkFrame at 0xbc50
_IsExceptionObjectToBeDestroyed at 0xbc10
_SetWinRTOutOfMemoryExceptionCallback at 0x2440
...
[C:\WINDOWS\SYSTEM32\ucrtbase_clr0400.dll, 0x7ffda90a0000]
.text: 0x1000 ~ 0x8ab40
.rdata: 0x8b000 ~ 0xb1ff4
.data: 0xb2000 ~ 0xb4158
.pdata: 0xb5000 ~ 0xbaa78
.rsrc: 0xbb000 ~ 0xbb418
.reloc: 0xbc000 ~ 0xbcaac
_Cbuild at 0x1d00
_Cmulcc at 0x1dd0
_Cmulcr at 0x1eb0
_Exit at 0x14b0
_FCbuild at 0x1540
...
[C:\WINDOWS\System32\psapi.dll, 0x7ffdb89e0000]
.text: 0x1000 ~ 0x1467
.rdata: 0x2000 ~ 0x30f8
.data: 0x4000 ~ 0x4580
.pdata: 0x5000 ~ 0x503c
.rsrc: 0x6000 ~ 0x63e0
.reloc: 0x7000 ~ 0x7018
EmptyWorkingSet at 0x1340
EnumDeviceDrivers at 0x1050
EnumPageFilesA at 0x1350
EnumPageFilesW at 0x1360
EnumProcessModules at 0x1010
...
[C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\ce65e35ae3e57af12f3515300d00e518\mscorlib.ni.dll, 0x7ffd97720000]
.data: 0x1000 ~ 0x539a30
.text: 0x53a000 ~ 0x1576539
.reloc: 0x1577000 ~ 0x15ff574
...
[C:\WINDOWS\System32\ole32.dll, 0x7ffdb9c90000]
.text: 0x1000 ~ 0xc7e29
.proxy: 0xc8000 ~ 0xc983c
.rdata: 0xca000 ~ 0x126132
.data: 0x127000 ~ 0x128f10
.pdata: 0x129000 ~ 0x137718
.didat: 0x138000 ~ 0x1382f0
.rsrc: 0x139000 ~ 0x14e240
.reloc: 0x14f000 ~ 0x1551e4
BindMoniker at 0x3e620
CLIPFORMAT_UserFree at 0x11a2b1
CLIPFORMAT_UserFree64 at 0x11a2e3
CLIPFORMAT_UserFreeExt at 0x52520
CLIPFORMAT_UserMarshal at 0x11a318
...
[C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll, 0x7ffda6310000]
.text: 0x1000 ~ 0x114744
.rdata: 0x115000 ~ 0x12e160
.data: 0x12f000 ~ 0x1311b8
.pdata: 0x132000 ~ 0x14bdf4
.tls: 0x14c000 ~ 0x14c011
.rsrc: 0x14d000 ~ 0x14d468
.reloc: 0x14e000 ~ 0x14e4f4
getJit at 0x91480
jitStartup at 0x923f0
sxsJitStartup at 0x914f0
...
[C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\9803982d7bc887e2745bff18a434ece1\System.ni.dll, 0x7ffd7a3c0000]
.data: 0x1000 ~ 0x2a4520
.text: 0x2a5000 ~ 0xc3295b
.reloc: 0xc33000 ~ 0xc6fc54
...
[C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\54311e67e34cb0c9f0d74b123f759d8d\System.Core.ni.dll, 0x7ffd791b0000]
.data: 0x1000 ~ 0x33c1d0
.text: 0x33d000 ~ 0xa16828
.reloc: 0xa17000 ~ 0xa747d8
...
(
첨부 파일은 이 글의 예제 코드를 포함합니다.)
[이 글에 대해서 여러분들과 의견을 공유하고 싶습니다. 틀리거나 미흡한 부분 또는 의문 사항이 있으시면 언제든 댓글 남겨주십시오.]