Viewing Contents Of a DLL File....

Question

hello there...
is this possible to view contents and Functions of a DLL file...
few times ago i was playing with OlyDBG then i found there is option for viewing contents of dll...
so suggest me any good tool or soft for this...

and suppose i have a DLL named "Python27.dll"...
now i need to view the content of this DLL so what do i do...
thanx...

Answer 1

I've done some work with ctypes, and loading dlls in windows, but I don't think DLL have any sort of introspection. This really isn't a big deal, because all of the function calls in DLLs are static. If your trying to use a undocumented DLL, you would not only need to know the names of the functions, but also the parameters of the functions. You would have to reverse engineer the DLL, no small task.

So, in my opinion, I would say no.

Answer 2

While not trivial to use (you need to understand the format of a Portable Executable, aka PE, file), pefile seems a good, powerful and versatile tool for the purpose of viewing a DLL or any other PE file (I wouldn't risk using it to change such a file, although I see it's one of its features).

For example, excerpting the module's usage examples (and editing to show a dll instead of the equally hypothetical filename they use, which is an exe;-):

import pefile
pe =  pefile.PE(‘/path/to/pefile.dll’)
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
  print hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal

should, according to the wikipage I pointed to, display something like:

0x7ca0ab4f SHUpdateRecycleBinIcon 336
0x7cab44c0 SHValidateUNC 173
0x7ca7b0aa SheChangeDirA 337
0x7ca7b665 SheChangeDirExA 338
0x7ca7b3e1 SheChangeDirExW 339
0x7ca7aec6 SheChangeDirW 340
0x7ca8baae SheConvertPathW 341

Answer 3

Dependency Walker may provide what you want/need -- it certainly shows all the entry points in a DLL.

Answer 4

On Windows, DUMPBIN provides some DLL inspection capabilities. For example:

DUMPBIN /EXPORTS C:\path\to\my.dll

will display all the exported definitions.