Parsing plain Win32 PE File (Exe/DLL) in .NET

Question

I need to parse plain Win32 DLL/Exe and need to get all imports and exports from it and to show it on console or GUI(say Win Forms). Is it possible to parse Win32 DLL/Exe in C#.NET, read its export table,import table and get managed types from it. As its unmanaged PE(.NET doesn't allows you to convert unmanaged PE files to managed .NET assemblies, only it generates COM managed assemblies).

So how to parse export and import tables of PE files and take all methods(signatures from it) in managed form.(e.g if char* as argument, it should display as IntPtr)

Answer 1

There is an open source project on codeplex called "PInvoke Interop Assistant" which allows extraction of method signatures from native dlls i.e for exported functions:

http://clrinterop.codeplex.com/releases/view/14120

If your intentions comply with the licensing agreement, perhaps you could look at the source code for that.

Update

Oops jumped the gun there. The tool I mentioned above does not work with native dlls, it only works with header files...

Answer 2

As regards the second part of your question, getting the method signatures, this is, as a general rule, impossible. That information is not usually stored in the PE itself. For C++ functions it can be possible, because the mangled name will encode that information, but many DLLs do not expose C++ interfaces. For COM interfaces, this information is stored in a type library, often embedded as a resource in the PE. To see if this is possible for the specific dlls you have in mind you can use dumpbin and undec to see if the functions are C++ mangled names. If not, you will need some other source of information like header files to create proper P/Invoke signatures (in which case you probably don't need to parse the PE file).

Answer 3

Parsing PE files is possible using the Microsoft Portable Executable Specification Document. However, as Logan noted, the signatures are not included in the PE file; only the names of the exported functions are included.

UPDATE: If your dll is a C++ dll created by a recent version of Microsoft's C++ compiler, then you can undecorate the mangled name to get most of the signature by calling this function: UnDecorateSymbolName from Debugging Tools for Windows. However, the return value is not included in the mangled name.

Answer 4

There is a parser known as PeParser - available at www.wintor.net/en/pestudio.html. Using PInvoke, you can consume it from .NET and get details shown by PeStudio.