Getting import table from DLL - windows

Question

Attaching to DLL as memory dump with WinDbg looks like (for example)
cdb -z %__appdir__%kernel32.dll
It works fine, now I can read NT_IMAGE_HEADER structure
!dh kernel32 -f
For reading export table I use next technique
dd kernel32+262c; * example of an export table RVA;
The is number of exported functions in second column of second row and offset to the start of the export table in first column of third row. Check it
dd kernel32+353c; * example of offset;
...; * take the first address in output;
da kernel32+4ba5
7c804ba5 "ActivateActCtx"
Bingo! Now we can use da again and again to see other exported functions but it's awful way. So it's better to use next trick
? (kernel32+353c); * get hexadecimal address of first exported function;
r? #$t0 = (int *)0x7c80353c; * set the pointer on that address into pseudo-register;
.for (r #$t1 = 0; #$t1 < 3ba; r #$t1 = #$t1 + 1) {da kernel32+(##c++(#$t0[#$t1]));}
What's my problem? At present moment I'm trying to read imported functions but when I type
dps kernel32+1000
where 1000 is RVA to the Import Address Table Directory I've got only part of addresses of names, not names. So, how can I get list of all names of the imported functions? Is there a simplest way or should I write a cycle again? How should be cycle look like?

Answer 1

cdb -z is used for loading dump files
using them for loading binaries have several side effects
and may include not loading pages that belong to import table
import table fill up needs interaction by loader to resolve imported address
when you load a binary as a dumpfile no other modules are loaded along with it
but dump file has information about other dlls needed in the module stream
so when you try to read some data from unloaded memory region
you are presented with ??? (question marks)
actually windbg has three bang commands that you can use for the purpose
they are
!showexports { address / mod }
!showimports { address / mod }
!showresources { address / mod }
the !showimports command also will not work on binary files loaded as dump
(cdb may hang trying to ReadARange and iirc i sent off a mail to windbg team long ago
(during 6.0 or xp era ) but the same hang appears in 17763 windbg which is latest as on the date of post
your efforts to read imports the way you describe will work better if you load an actual dump instead of binary file as dump
to confirm you can use !vadump command and you will see cdb has mapped
pages after the size of import table
C:\>cdb -c "!dh kernel32;q" -z c:\Windows\System32\kernel32.dll | grep -i "Import.*Address"
1000 [ DFC] address [size] of Import Address Table Directory
C:\>cdb -c "dd kernel32+1df0;q" -z c:\Windows\System32\kernel32.dll
Microsoft (R) Windows Debugger Version 10.0.16299.15 X86
Loading Dump File [c:\Windows\System32\kernel32.dll]
0:000> cdb: Reading initial command 'dd kernel32+1df0;q'
77de1df0 ???????? ???????? ???????? 90909090 <<<<<<<<<<<<<
77de1e00 90909090 90909090 90909090 90909090
quit:
C:\>cdb -c "!vadump;q" -z c:\Windows\System32\kernel32.dll
Microsoft (R) Windows Debugger Version 10.0.16299.15 X86
Loading Dump File [c:\Windows\System32\kernel32.dll]
0:000> cdb: Reading initial command '!vadump;q'
BaseAddress: 77de0000
RegionSize: 00001000
BaseAddress: 77de1dfc <<<<<<<<<<<<<<<
RegionSize: 000c4204
BaseAddress: 77ea6000
RegionSize: 00001000
BaseAddress: 77ea7000
RegionSize: 00001000
BaseAddress: 77ea8000
RegionSize: 0000c000
quit: