Is there any native DLL export functions viewer?

Question

Is there any free native Windows DLL export functions viewer, which shows the function name, and a list of their parameters?

score 121 · Answer 1 · edited Apr 05 '19 at 15:47

dumpbin from the Visual Studio command prompt:

dumpbin /exports csp.dll

Example of output:

Microsoft (R) COFF/PE Dumper Version 10.00.30319.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file csp.dll

File Type: DLL

  Section contains the following exports for CSP.dll

    00000000 characteristics
    3B1D0B77 time date stamp Tue Jun 05 12:40:23 2001
        0.00 version
           1 ordinal base
          25 number of functions
          25 number of names

    ordinal hint RVA      name

          1    0 00001470 CPAcquireContext
          2    1 000014B0 CPCreateHash
          3    2 00001520 CPDecrypt
          4    3 000014B0 CPDeriveKey
          5    4 00001590 CPDestroyHash
          6    5 00001590 CPDestroyKey
          7    6 00001560 CPEncrypt
          8    7 00001520 CPExportKey
          9    8 00001490 CPGenKey
         10    9 000015B0 CPGenRandom
         11    A 000014D0 CPGetHashParam
         12    B 000014D0 CPGetKeyParam
         13    C 00001500 CPGetProvParam
         14    D 000015C0 CPGetUserKey
         15    E 00001580 CPHashData
         16    F 000014F0 CPHashSessionKey
         17   10 00001540 CPImportKey
         18   11 00001590 CPReleaseContext
         19   12 00001580 CPSetHashParam
         20   13 00001580 CPSetKeyParam
         21   14 000014F0 CPSetProvParam
         22   15 00001520 CPSignHash
         23   16 000015A0 CPVerifySignature
         24   17 00001060 DllRegisterServer
         25   18 00001000 DllUnregisterServer

  Summary

        1000 .data
        1000 .rdata
        1000 .reloc
        1000 .rsrc
        1000 .text

Be careful not to execute 'dumpbin /export' accidentally ('s' is missing in the end), it's a completely different command. — Nikita R., Apr 17 '13 at 01:07

Moshe Levi · Accepted Answer · 2009-10-10T18:12:21.527

72

you can use Dependency Walker to view the function name. you can see the function's parameters only if it's decorated. read the following from the FAQ:

How do I view the parameter and return types of a function? For most functions, this information is simply not present in the module. The Windows' module file format only provides a single text string to identify each function. There is no structured way to list the number of parameters, the parameter types, or the return type. However, some languages do something called function "decoration" or "mangling", which is the process of encoding information into the text string. For example, a function like int Foo(int, int) encoded with simple decoration might be exported as _Foo@8. The 8 refers to the number of bytes used by the parameters. If C++ decoration is used, the function would be exported as ?Foo@@YGHHH@Z, which can be directly decoded back to the function's original prototype: int Foo(int, int). Dependency Walker supports C++ undecoration by using the Undecorate C++ Functions Command.

edited Oct 10 '09 at 18:12

answered Oct 10 '09 at 18:06

Moshe Levi

3,443
21
26

Thanks, but when I try to open any DLL, it shows in the log window: Error: At least one module has an unresolved import due to a missing export function in an implicitly dependent module. Error: Modules with different CPU types were found. Warning: At least one delay-load dependency module was not found. Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module. – Alon Gubkin Oct 10 '09 at 18:17
I'm using Windows 7 x64 Final. – Alon Gubkin Oct 10 '09 at 18:21
3

@Alon: Well, your application is quiet messed up :) the first error indicates that some of your dll's are compiled for 32bit systems and some for 64bit. you can only load dll's with the same CPU architecture in the same process. you can live with the other two errors as long as the application is handling them. – Moshe Levi Oct 10 '09 at 18:25
1

BTW, Those errors should not disturb you to view the exported function of the DLL in question. you should just click on this DLL and It's exported function will show up in the right window. – Moshe Levi Oct 10 '09 at 18:28
1

@Alon: I get those errors as well, for every DLL I ever look at. Just ignore them. – RichieHindle Oct 10 '09 at 18:51
Note: `?Foo@@YGHHH@Z` is definitely linker dependent - different venders and version are free to mangle c++ however they see fit; different linkers are NOT intended to produce compatible output. – some bits flipped Aug 07 '12 at 20:49
For an explanation of why you get erroneous "missing dll" errors, see [this answer](http://stackoverflow.com/a/36244610/212538) to a related question. – Janus Jan 30 '17 at 13:11
@MosheLevi, How does this differ from Nirsoft's dll exporter? – Pacerier Apr 29 '17 at 23:27

score 21 · Answer 3 · answered Oct 30 '13 at 09:21

21

DLL Export Viewer by NirSoft can be used to display exported functions in a DLL.

This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL files. You can easily copy the memory address of the desired function, paste it into your debugger, and set a breakpoint for this memory address. When this function is called, the debugger will stop in the beginning of this function.

enter image description here

answered Oct 30 '13 at 09:21

Magnus Lindhe

7,157
5
48
60

2

Nirsoft's application doesn't show up nameless functions :-( – TCS Sep 06 '16 at 07:44
The browse for DLL button is completed broken for me, also doesn't show any functions in dlls whatsoever. I'm using windows 10 (64bit) – Owl Jul 14 '17 at 13:52
1

@TCS "Unnamed Functions are now displayed in Ordinalxxx format. (When 'Display Unnamed Functions' option is turned on)" since version 1.45 – manuell Nov 28 '17 at 11:55

score 9 · Answer 4 · edited Apr 30 '19 at 04:04

If you don't have the source code and API documentation, the machine code is all there is, you need to disassemble the dll library using something like IDA Pro , another option is use the trial version of PE Explorer.

PE Explorer provides a Disassembler. There is only one way to figure out the parameters: run the disassembler and read the disassembly output. Unfortunately, this task of reverse engineering the interface cannot be automated.

PE Explorer comes bundled with descriptions for 39 various libraries, including the core Windows® operating system libraries (eg. KERNEL32, GDI32, USER32, SHELL32, WSOCK32), key graphics libraries (DDRAW, OPENGL32) and more.

_{(source: heaventools.com)}

How does this differ from Nirsoft DLL Export Viewer? – Pacerier Apr 29 '17 at 23:21 — Pacerier, Apr 29 '17 at 23:21

Is there any native DLL export functions viewer?

4 Answers4

Linked