Share |

Wednesday, January 26, 2011

How to dump DLL exports

You can dump .dll using this method
To print the function names that a Windows dynamic link library exports (DLL), you can use the dumpbin.exe tool, which comes with Visual Studio. For example, the following command line exports all functions in mshtml.dll :
C:\>dumpbin.exe /exports C:\WINDOWS\ie8\mshtml.dll
Microsoft (R) COFF/PE Dumper Version 9.00.30729.01
Copyright (C) Microsoft Corporation. All rights reserved.


Dump of file C:\WINDOWS\ie8\mshtml.dll

File Type: DLL

Section contains the following exports for MSHTML.dll

00000000 characteristics
41107F09 time date stamp Wed Aug 04 11:45:37 2004
0.00 version
1 ordinal base
19 number of functions
19 number of names

ordinal hint RVA name

1 0 00141BB8 CreateHTMLPropertyPage
2 1 000BDFF6 DllCanUnloadNow
3 2 0013D3C2 DllEnumClassObjects
4 3 000E1AA6 DllGetClassObject
5 4 0013D243 DllInstall
6 5 0013D319 DllRegisterServer
7 6 0013D38D DllUnregisterServer
8 7 0019BCA4 MatchExactGetIDsOfNames
9 8 00140BD5 PrintHTML
10 9 001AD7CB RNIGetCompatibleVersion
11 A 001AA454 RunHTMLApplication
12 B 001A691E ShowHTMLDialog
13 C 001A692E ShowHTMLDialogEx
14 D 001A689A ShowModalDialog
15 E 001A5FEA ShowModelessHTMLDialog
16 F 001AD7D6 com_ms_osp_ospmrshl_classInit
17 10 001ADA6E com_ms_osp_ospmrshl_copyToExternal
18 11 001ADB14 com_ms_osp_ospmrshl_releaseByValExternal
19 12 001AD80C com_ms_osp_ospmrshl_toJava

Summary

D000 .data
1F000 .reloc
1B000 .rsrc
29A000 .text