Skip to content

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

License

Notifications You must be signed in to change notification settings

gmh5225/DLL-Hijack-ExportDumper

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

ExportDumper

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

Usage

.\ExportDump dllpath

e.g.

.\ExportDump C:\Windows\System32\version.dll
[*] Dumping all 17 exported functions from C:\windows\system32\version.dll.
[+] Dumping done. Check pragma.h

Copy paste the contents of pragma.h into your project, or just include it, and all exported functions should be linked from the copy you have on disk.

pragma.h

#pragma comment(linker, "/export:GetFileVersionInfoA=C:\\windows\\system32\\version.GetFileVersionInfoA,@1")
#pragma comment(linker, "/export:GetFileVersionInfoByHandle=C:\\windows\\system32\\version.GetFileVersionInfoByHandle,@2")
#pragma comment(linker, "/export:GetFileVersionInfoExA=C:\\windows\\system32\\version.GetFileVersionInfoExA,@3")
#pragma comment(linker, "/export:GetFileVersionInfoExW=C:\\windows\\system32\\version.GetFileVersionInfoExW,@4")
#pragma comment(linker, "/export:GetFileVersionInfoSizeA=C:\\windows\\system32\\version.GetFileVersionInfoSizeA,@5")
#pragma comment(linker, "/export:GetFileVersionInfoSizeExA=C:\\windows\\system32\\version.GetFileVersionInfoSizeExA,@6")
#pragma comment(linker, "/export:GetFileVersionInfoSizeExW=C:\\windows\\system32\\version.GetFileVersionInfoSizeExW,@7")
#pragma comment(linker, "/export:GetFileVersionInfoSizeW=C:\\windows\\system32\\version.GetFileVersionInfoSizeW,@8")
#pragma comment(linker, "/export:GetFileVersionInfoW=C:\\windows\\system32\\version.GetFileVersionInfoW,@9")
#pragma comment(linker, "/export:VerFindFileA=C:\\windows\\system32\\version.VerFindFileA,@10")
#pragma comment(linker, "/export:VerFindFileW=C:\\windows\\system32\\version.VerFindFileW,@11")
#pragma comment(linker, "/export:VerInstallFileA=C:\\windows\\system32\\version.VerInstallFileA,@12")
#pragma comment(linker, "/export:VerInstallFileW=C:\\windows\\system32\\version.VerInstallFileW,@13")
#pragma comment(linker, "/export:VerLanguageNameA=C:\\windows\\system32\\version.VerLanguageNameA,@14")
#pragma comment(linker, "/export:VerLanguageNameW=C:\\windows\\system32\\version.VerLanguageNameW,@15")
#pragma comment(linker, "/export:VerQueryValueA=C:\\windows\\system32\\version.VerQueryValueA,@16")
#pragma comment(linker, "/export:VerQueryValueW=C:\\windows\\system32\\version.VerQueryValueW,@17")

About

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C# 100.0%