DLL Export Viewer

Post your working scripts, libraries and tools for AHK v1.1 and older
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

25 Jul 2017, 06:36

jNizM wrote:your first image is too small to decipher...
Sorry, not my fault - the board automatically resizes large images to max. 800px wide.

[EDIT]
OK, it still doesn't work right with my solution but at least it doesn't crash anymore. Will keep digging.
Part of my AHK work can be found here.
just me
Posts: 9424
Joined: 02 Oct 2013, 08:51
Location: Germany

Re: DLLExport

25 Jul 2017, 08:07

Hi Drugwash,

I'm using 1.1.25.02 too, and everything is working flawlessly on Win 10 x64. PSTR is defined as: "A pointer to a null-terminated string of 8-bit Windows (ANSI) characters.".
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

25 Jul 2017, 10:29

Goddamn stupid operating system! :(

Finally I found out what the issue is: the imagehlp library must be preloaded before mapping the file and retrieving information, otherwise it crashes while trying to retrieve and convert ModuleName - at least in XP.
After various attempts at tweaking and retrieving the darn string I just added LoadLibrary() before MapAndLoad() and FreeLibrary() before GetDllExports() returns. Everything went fine afterwards: no more crashes and the path is retrieved correctly.

MSND (at least the 2005 version that I'm working with) mentions all imagehlp functions are single-threaded so in theory there shouldn't be any problems (I finally fixed the old script too and 98SE doesn't need any library preloading) but who knows what quirks may lie in some specific combination of AHK + OS.

Anyway, while fixing this I also added an extra field to the details dialog: Image size, which is nothing but the file size. Sometimes it may be of help when working with different versions of libraries.
Export := { ModuleName: "", Total: 0, Names: 0, OrdBase: 0, Bitness: 0, ImgSz:0, Functions: [] }
Export.ImgSz := NumGet(LOADED_IMAGE, 8*A_PtrSize+12, "uint")

A few minor additions are required to:
LV_LoadFiles()
, s: DllExports.ImgSz

LV_ShowTable()
LV_Add("", v.i, v.n, v.o, v.e, v.m, v.p, v.s)

LV_SearchTable()
LV_Add("", v.i, v.n, v.o, v.e, v.m, v.p, v.s)

ChildInfo()
ChildInfo(function, rva, ordinal, module, path, size)
Gui, Info: Add, Text, xm y+4 w180 h25 0x200, % "Image Size [bytes]:"
Gui, Info: Add, Edit, x+1 yp w350 0x800, % size

20170725184245-edit.7z
screenshot and modified script
(154.84 KiB) Downloaded 165 times
[EDIT]
One more small change that didn't make it to the modified script and is required for XP and any other OS versions that do not have imageres.dll:
try Menu, Tray, Icon, imageres.dll, 63
catch
Menu, Tray, Icon, shell32.dll, 73
Part of my AHK work can be found here.
sancarn
Posts: 224
Joined: 01 Mar 2016, 14:52

Re: DLLExport

25 Jul 2017, 13:57

Sweet update! 8-)
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

26 Jul 2017, 05:59

@ jNizM : Have you tried using some combination of flags in the Undecorate() function instead of zero?
I've tried 0x1FFF and 0x3FFF, they seem to clean up the symbols better but I'm not really sure if it's alright.

In the modified script above (nobody was curious about it?) the ImgSz column in ListViews should be set to zero; I forgot to do it.
Part of my AHK work can be found here.
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

26 Jul 2017, 06:10

@Drugwash
Atm I work on some cleanup in gui functions / labels. After this I will watch about ImgSz and Undecorate flags.
Icon is now changed to your suggestion (shell32.dll#73)

@just me
Your IconEx (v1.4u) gives me a wrong number in windows 10 for this Icon (154 instand of 73) - 154 is a CD-Icon
Also the preview of the icons does not work
Maybe you got some time to look into it ;)
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

26 Jul 2017, 06:16

OK and sorry, I don't mean to push or anything - just trying to help.
Thanks for the icon, should be fine and consistent for everyone now.
Part of my AHK work can be found here.
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

26 Jul 2017, 07:30

No need to say sorry. All feature requests, bug reports or reviews are welcome =)
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
just me
Posts: 9424
Joined: 02 Oct 2013, 08:51
Location: Germany

Re: DLLExport

26 Jul 2017, 07:37

Hi jNizM,

what is my IconEx?
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

26 Jul 2017, 07:38

You did a AHK Unicode review of SKANS IconEx (v1.4u)
I'll pm you the code =)
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

26 Jul 2017, 08:08

Update:
- Bugfixes in gui labels
- Bugfixes in loading ListView (Messageloop) - thx to 'just me'
- Bugfixes for imagehlp.dll in Windows XP - thx to Drugwash
- Changed Menu Icon to shell32.dll#73 - thx to Drugwash
- Added IsExpandView in globals (default is on)

@Drugwash
Would it be enough to use if (DllFile = "imagehlp.dll") -> LoadLibrary("imagehlp.dll")? Can you test it?
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

26 Jul 2017, 09:22

Great job, thanks! New default for expanded view is better too, in my opinion. :thumbup:

One thing is not quite clear to me, thought I should ask: why are module name and path duplicated for each exported function in the list? Seems like waste of resources. In case they would point to a forwarded module then it may be best to keep those columns empty for currently loaded module name and path, and only fill them in if a forwarding is encountered. Please correct me if I'm wrong.

Further suggestions:
- display currently loaded module name in main window title (i.e. Dll Export Viewer [msvcr120.dll] or something)
- add a small search box for the expanded view's list
- add a module count for the expanded view's list (optional)
- add a code-to-function search box, useful in debugging; explanation: type or paste a code address (such as the one returned by the system error report) and it will show the function it belongs to (see my first screenshot and error report about kernel32 -> WideCharToMultiByte)
- for a cleaner display show undecorated names by default in the list and display the full decorated names in the details dialog

Unrelated (just caught your discussion with just me): did you ever try my VersionInfo Lister for icons? Can't test it in x64 myself, I wonder if it works (correctly or at all). Might help with icon group <=> icon index issue.

[EDIT]
Would it be enough to use if (DllFile = "imagehlp.dll") -> LoadLibrary("imagehlp.dll")? Can you test it?
The library imagehlp.dll should be preloaded from the very start of the script, for it to work (in XP). I added it to GetDllExports() in desperation but best would be to preload it at script start and free the library on exit, instead of load/unload for each selected library. Sorry for the confusion. :oops:
Last edited by Drugwash on 26 Jul 2017, 12:40, edited 2 times in total.
Part of my AHK work can be found here.
just me
Posts: 9424
Joined: 02 Oct 2013, 08:51
Location: Germany

Re: DLLExport

26 Jul 2017, 09:26

jNizM wrote:@just me
Your IconEx (v1.4u) gives me a wrong number in windows 10 for this Icon (154 instand of 73) - 154 is a CD-Icon
IconEx is showing the internal group ID, not the group index used by AHK.
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

28 Jul 2017, 05:21

Update (v0.6)
- Bugfixes in Load-, Show- and Search Table
- Changed LoadLibrary(imagehlp) into script load (but only if winos = xp)
- Added currently loaded module name in main window title
- Added enter (return) key functionality (similar to doubleclick) in LV2 via WindowProc since the Enter keystroke is not received in ListView's
- Added FileInfo (OriginalFilename / CompanyName / ProductVersion / FileVersion)

Update (v.0.6.1)
- small bugfixes

... more in work
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

28 Jul 2017, 05:55

Works fine in XP, thank you. :)

Another idea just crossed my mind: how about a global export function search as an advanced menu option or something? Say you find some C code that calls some WINAPI and you don't know which module(s) export(s) them in order to convert or adapt the code to AHK's DllCall(). Type in the API names (one at a time or all in same line?) in DllExport and it will find (and optionally load?) the module(s) if present on the system. ;)
Part of my AHK work can be found here.
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

28 Jul 2017, 06:14

@Drugwash
Thanks and I will look at it.


(possible) Todo-List
- enumerating all modules for a specific process (all modules will be shown in LV2)
- enumarating all modules for all processes (all modules will be shown in LV2)
- global function search for a specific folder (all modules from this folder are shown in LV2)
- open google for a specific function (via right-click and / or menu)
- searchbox for LV2
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

28 Jul 2017, 06:46

One small amendment regarding the ToDo: please do not hardcode Google for web search. Some of us may have other preferred search engine(s).
Also best would be to allow for a user-defined browser instead of default one. And maybe hardcode a direct MSDN search besides the other(s), but also with user-customized browser.

Personally I blocked most of Google's domains in HOSTS and I never use it for search (screenshot offers a hint). Also, Pale Moon is set as default browser but it's so bloated with add-ons that I rarely fire it up lately, preferring the much lighter QtWeb instead for trivial actions such as web search. Maybe I'm not the only one with such setup, dunno.
Therefore I believe it would be great if browser and search engine(s) could be customized at will. If you want I can send you a couple of related scripts that deal with (un)registered browsers.
Part of my AHK work can be found here.
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLLExport

28 Jul 2017, 07:17

It would be like this for eg msdn
global WebSearchEngine := "https://social.msdn.microsoft.com/search/en-US?query="
WebSearchEngine . SearchQuery

Looks like msdn use bing as search engine

How should the window title looks like?

With or without space?
- DLL Export Viewer [kernel32.dll]
- DLL Export Viewer [ kernel32.dll ]
With comma or slash?
- DLL Export Viewer [ kernel32.dll, shell32.dll, ... ]
- DLL Export Viewer [ kernel32.dll / shell32.dll / ... ]
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
User avatar
Drugwash
Posts: 850
Joined: 29 May 2014, 21:07
Location: Ploieşti, Romania
Contact:

Re: DLLExport

28 Jul 2017, 08:09

The search URL may vary in regard to the query format, depending on engine. I've looked for the URLs and queries in my Pale Moon profile but unfortunately couldn't find them (not the useful ones).
There's also the loose query vs strict query (keywords enclosed in double quotes). Dunno how each search engine deals with that but when searching the web for a specific API by name maybe the strict query should be used.

Besides MSDN maybe StackOverflow would be useful too and maybe there are other useful programming-related sites that offer a search function.
Makes sense for M$ to use their own engine for their own domains. (I wonder if they use Windows machines for coding the Windows OS but that's off-topic :D )

Published the scripts mentioned above, find them at IEMenuExt.
Please note the included MI script (Menu Icons by Lexikos) may not be x64-safe. Browser registration should be OK though (I guess).
Spaces make lib name a tad more readable so yes.
Comma would spare a space char for each name and represents an enumeration better than slash (which could induce the idea of a comparison) so better go with comma.
Part of my AHK work can be found here.
User avatar
jNizM
Posts: 3183
Joined: 30 Sep 2013, 01:33
Contact:

Re: DLL Export Viewer

03 Aug 2017, 03:35

Something like this? Experimental GUI
Image
Enumerating all modules for a process (PID) is also finished
GetProcessModules(ProcessID) for XP and GetProcessModulesEx(ProcessID) for Vista+
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile

Return to “Scripts and Functions (v1)”

Who is online

Users browsing this forum: No registered users and 134 guests