参考代码:
{
public static readonly ushort IMAGE_DIRECTORY_ENTRY_EXPORT = 0;
private const CallingConvention CALLING_CONVENTION = CallingConvention.Winapi;
private const string KERNEL_DLL = "kernel32";
private const string DBGHELP_DLL = "dbghelp";
[DllImport(KERNEL_DLL, CallingConvention = CALLING_CONVENTION, EntryPoint = "LoadLibrary"), SuppressUnmanagedCodeSecurity]
public static extern uint LoadLibrary(string lpFileName);
[DllImport(KERNEL_DLL, CallingConvention = CALLING_CONVENTION, EntryPoint = "FreeLibrary"), SuppressUnmanagedCodeSecurity]
public static extern bool FreeLibrary(uint hModule);
[DllImport(DBGHELP_DLL, CallingConvention = CALLING_CONVENTION, EntryPoint = "ImageDirectoryEntryToData"), SuppressUnmanagedCodeSecurity]
public static extern void* ImageDirectoryEntryToData(void* Base, bool MappedAsImage, ushort DirectoryEntry, out uint Size);
}
public unsafe class ParserDLLClass
{
[StructLayout(LayoutKind.Sequential)]
public struct IMAGE_EXPORT_DIRECTORY
{
public UInt32 Characteristics;
public UInt32 TimeDateStamp;
public UInt16 MajorVersion;
public UInt16 MinorVersion;
public UInt32 Name;
public UInt32 Base;
public UInt32 NumberOfFunctions;
public UInt32 NumberOfNames;
public UInt32 AddressOfFunctions; // RVA from base of image
public UInt32 AddressOfNames; // RVA from base of image
public UInt32 AddressOfNameOrdinals; // RVA from base of image
}
[StructLayout(LayoutKind.Explicit)]
public struct IMAGE_THUNK_DATA32
{
[FieldOffset(0)]
public uint ForwarderString; // PBYTE
[FieldOffset(4)]
public uint Function; // PDWORD
[FieldOffset(8)]
public uint Ordinal;
[FieldOffset(12)]
public uint AddressOfData; // PIMAGE_IMPORT_BY_NAME
}
public class FunctionInfo
{
public string Name;
public FunctionInfo(string strFuncName)
{
Name = strFuncName;
}
}
public static void GetExportFunctionName(string dllFileName, ref List<FunctionInfo> listFunc)
{
uint handle = class1.LoadLibrary(dllFileName);
if (handle != 0)
{
uint size = 0;
void* baseAddr = (void*)handle;
IMAGE_EXPORT_DIRECTORY* export = (IMAGE_EXPORT_DIRECTORY*)class1.ImageDirectoryEntryToData((void*)handle, true, class1.IMAGE_DIRECTORY_ENTRY_EXPORT, out size);
void* ENT = (byte*)baseAddr + export->AddressOfNames; // ExportNameTable
UInt32 numFunc = export->NumberOfFunctions;
UInt32* nameTableRVA = (UInt32*)(ENT);
UInt16* ordinal = (UInt16*)((byte*)baseAddr + export->AddressOfNameOrdinals);
char* funcName = null;
for (UInt32 i = 0; i < numFunc; ++i)
{
funcName = (char*)((byte*)baseAddr + nameTableRVA[i]);
string strFuncName = Marshal.PtrToStringAnsi((IntPtr)funcName);
listFunc.Add(new FunctionInfo(strFuncName));
}
class1.FreeLibrary(handle);
}
}
}
以上仅为实验的代码,仅供参考