Another (almost useless) test proggy... someone might find it useful or educational. :)

It reads the exports table from any DLL and generates a DEF file. It works Ok for dlls I have built myself, but when trying it with some system DLLs it seems to generate some garbage in the end... does anyone know why? :confused:
Posted on 2004-05-13 11:27:09 by QvasiModo
Mario,

It work fine on a third party dll and kernel32(W2K-SP4).

Which system dlls did you notice the problem on?

BTW, Fine piece of work there.

Regards, P1 :cool:
Posted on 2004-05-13 14:07:16 by Pone
Hi Pone, thanks for your kind words. :)

I noticed a problem with wsock32.dll under W98. It seems to be outputting a large number of nameless imports, all with an ordinal of 1.
Posted on 2004-05-14 15:09:45 by QvasiModo
I don't think you should be too worried about wsock32.dll. That file has some weird crap in it! A few disassemblers even fail to disassemble it.
Posted on 2004-05-17 02:38:40 by SubEvil
Hi QvasiModo,

Your work is not useless, it demonstrates the use of imagehlp.dll

With my own dll2def tool ( coded before year), I dumped the functions exported by wsock32.dll, plus I tried the MS dumpbin tool:


\masm32\bin\dumpbin /exports \windows\system32\wsock32.dll


Yet, I couldn't view those strange functions displayed by your tool, is it possible that wsock32.dll has some undocumented features?

O.S:Win Xp HE Sp1a

Keep up your work:alright:
Posted on 2004-05-17 11:56:17 by Vortex

Hi QvasiModo,
Your work is not useless, it demonstrates the use of imagehlp.dll

Thanks! :)

With my own dll2def tool ( coded before year), I dumped the functions exported by wsock32.dll, plus I tried the MS dumpbin tool:


\masm32\bin\dumpbin /exports \windows\system32\wsock32.dll


Yet, I couldn't view those strange functions displayed by your tool, is it possible that wsock32.dll has some undocumented features?

O.S:Win Xp HE Sp1a

Keep up your work:alright:


Not likely, your tool is not reporting this exports simply because it doesn't look for functions exported by ordinal only (no name). I don't really know about dumpbin. My app is simply "making up" this names.

Probably I made a mistake, or wsock32.dll is not 100% PE compatible.. it doesn't need to be as long as the system can load it successfully, and since functions will only be searched for ordinal in MS apps the "bogus" ones would never get used.
Posted on 2004-05-21 18:20:26 by QvasiModo