CasualX / pelite

Lightweight, memory-safe, zero-allocation library for reading and navigating PE binaries.
MIT License
290 stars 42 forks source link

Not getting all exports #275

Closed MolotovCherry closed 8 months ago

MolotovCherry commented 8 months ago

I tested this on C:\Windows\System32\winmm.dll, and dumpbin gives me the following report:

C:\Windows\System32 ❯ dumpbin /exports winmm.dll
Microsoft (R) COFF/PE Dumper Version 14.39.33519.0
Copyright (C) Microsoft Corporation.  All rights reserved.

Dump of file winmm.dll

File Type: DLL

  Section contains the following exports for WINMM.dll

    00000000 characteristics
    3C007A3E time date stamp
        0.00 version
           2 ordinal base
         193 number of functions
         192 number of names

// snip -> 192 functions follows

But when I call .iter_name_indices I am getting only 180, with quite a few of the names missing. Not only that, but many of the indexes returned do not match up with the actual functions that dumpbin is telling me, causing me to generate incorrect function -> index data

use pelite::{util::CStr, FileMap, PeFile};

fn main() {
    let mapping = FileMap::open(r"C:\Windows\System32\winmm.dll").unwrap();
    let pe_file = PeFile::from_bytes(&mapping).unwrap();
    let exports = pe_file.exports().unwrap();
    let exports_by = exports.by().unwrap();

    let mut export_names = Vec::<Option<&CStr>>::new();
    export_names.resize(exports_by.functions().len(), None);
    for (name, index) in exports_by.iter_name_indices() {
        export_names[index] = Some(name.unwrap());
    }

    let ordinal_base = exports.ordinal_base() as usize;

    println!(
        "ordinal base {ordinal_base:?}\n{export_names:#?}\nnum_funcs: {}",
        exports_by.functions().len()
    );
}
MolotovCherry commented 8 months ago

Okay. To anyone else who encounters this, this was caused by accidentally using an x86 developer console instead of spawning an x86_64 dev console. Dumpbin being x86 process can confuse things since the system will read from syswow64 in some cases even though you gave it the x64 path, giving you a different result than you'd expect