function getProcList(libs:
array of hModule;
const FunctionNames:TStringlist):boolean;
var Exp:PImageExportDirectory;
i,a:integer;
name:
string;
addr:pointer;
index:integer;
listfilled:integer;
lib:integer;
begin
try
listfilled:=0;
for a:=0
to high(libs)
do
begin
lib:=libs[a];
//a-te Library aus libs lesen
if (lib=0)
or
(PWord(pointer(lib))^<>$5A4D)
or
(PImageNTHeaders(PImageDosHeader(pointer(lib))^._lfanew+lib)^.Signature<>$4550)
then continue;
//ist keine Win-DLL/EXE
//ExportTabelle finden
Exp:=pointer(PInteger(@PImageNTHeaders(PImageDosHeader(pointer(lib))^._lfanew+lib)^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT])^+lib);
//alle Export-Einträge durchlaufen
for i:=0
to exp^.NumberOfNames-1
do
begin
//Name der i-ten Export-Funktion
name:=pchar(pinteger(integer(exp^.AddressOfNames)+lib+i*4)^+lib);
//Name in Liste suchen
index:=Functionnames.IndexOfName(
name);
if index>=0
then
begin
//Adresse der i-ten Export-Funktion
addr:=pointer(pinteger(integer(exp^.AddressOffunctions)+lib+i*4)^+lib);
//Adresse in Liste speichern
Functionnames.ValueFromIndex[
index]:=inttostr(integer(addr));
inc(listfilled);
end;
end;
end;
result:=listfilled=Functionnames.Count;
except
result:=false;
//was auch immer
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
var list:TStringlist;
begin
list:=TStringlist.create;
list.Add('
CreateWindowExA=');
list.Add('
CreateWindowExW=');
list.add('
GetProcAddress=');
if getProcList([getmodulehandle('
user32.dll'),
getmodulehandle('
kernel32.dll')],
list)
then memo1.lines.addstrings(list);
end;