Skip to content

A similar Linux ldd command for EXE files... for DLL hijacking prevention or exploitation

Notifications You must be signed in to change notification settings

hanshaze/ldd-win

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 

Repository files navigation

ldd-win

A similar Linux ldd command for EXE files... for DLL hijacking prevention or exploitation.

Examples:

$ python2 ldd-win.py calc.exe
PE Exports
--------------------------------------------------------------------------------
	ADVAPI32.DLL			[ # imported functions: 17]
	COMCTL32.DLL			[ # imported functions: 09]
	GDIPLUS.DLL			[ # imported functions: 25]
	GDI32.DLL			[ # imported functions: 27]
	KERNEL32.DLL			[ # imported functions: 88]
	MSVCRT.DLL			[ # imported functions: 89]
	NTDLL.DLL			[ # imported functions: 05]
	OLEAUT32.DLL			[ # imported functions: 06]
	OLE32.DLL			[ # imported functions: 03]
	RPCRT4.DLL			[ # imported functions: 03]
	SHELL32.DLL			[ # imported functions: 05]
	SHLWAPI.DLL			[ # imported functions: 01]
	UXTHEME.DLL			[ # imported functions: 01]
	USER32.DLL			[ # imported functions: 97]
	VERSION.DLL			[ # imported functions: 03]
	WINMM.DLL			[ # imported functions: 01]

$ python2 ldd-win.py calc.exe -v 
PE Exports
--------------------------------------------------------------------------------
	ADVAPI32.DLL			[ # imported functions: 17]
		RegEnumKeyExW (0x1001088)
		RegOpenKeyExW (0x100108c)
		RegQueryInfoKeyW (0x1001090)
		RegGetValueW (0x1001094)
		RegEnumValueW (0x1001098)
		RegDeleteKeyW (0x100109c)
		RegQueryValueExW (0x10010a0)
		RegSetValueExW (0x10010a4)
		OpenSCManagerW (0x10010a8)
		OpenServiceW (0x10010ac)
		QueryServiceConfigW (0x10010b0)
		CloseServiceHandle (0x10010b4)
		RegCreateKeyExW (0x10010b8)
		RegCloseKey (0x10010bc)
		EventWrite (0x10010c0)
		EventUnregister (0x10010c4)
		EventRegister (0x10010c8)
	COMCTL32.DLL			[ # imported functions: 09]
		ImageList_Destroy (0x1001104)
		ImageList_Add (0x1001108)
		ImageList_Create (0x100110c)
		None (0x1001110)
		CreatePropertySheetPageW (0x1001114)
		PropertySheetW (0x1001118)
		None (0x100111c)
		None (0x1001120)
		None (0x1001124)
	GDIPLUS.DLL			[ # imported functions: 25]
		GdipDrawLineI (0x1001020)
		GdipDrawArcI (0x1001024)
		GdipFillRectangleI (0x1001028)
		GdipCloneBrush (0x100102c)
		GdipCloneImage (0x1001030)
		GdipCreateBitmapFromHBITMAP (0x1001034)
		GdipCreateFromHDC (0x1001038)
		GdipDrawImageRectI (0x100103c)
		GdipSetInterpolationMode (0x1001040)
		GdipSetPageUnit (0x1001044)
		GdipCreateSolidFill (0x1001048)
		GdipCreateBitmapFromScan0 (0x100104c)
		GdipDisposeImage (0x1001050)
		GdipDeleteGraphics (0x1001054)
		GdipDeletePen (0x1001058)
		GdipCreatePen1 (0x100105c)
		GdipDeleteBrush (0x1001060)
		GdipAlloc (0x1001064)
		GdipFree (0x1001068)
		GdiplusStartup (0x100106c)
		GdiplusShutdown (0x1001070)
		GdipGetImageGraphicsContext (0x1001074)
		GdipSetSmoothingMode (0x1001078)
		GdipCloneBitmapAreaI (0x100107c)
		GdipCreateHBITMAPFromBitmap (0x1001080)
	GDI32.DLL			[ # imported functions: 27]
		EqualRgn (0x1001458)
		CreateDIBSection (0x100145c)
		DeleteObject (0x1001460)
		DeleteDC (0x1001464)
		GetTextExtentPointW (0x1001468)
		CreateFontIndirectW (0x100146c)
		CreateCompatibleDC (0x1001470)
		GetDeviceCaps (0x1001474)
		GetRgnBox (0x1001478)
		CreateSolidBrush (0x100147c)
		GetTextMetricsW (0x1001480)
		GetTextExtentPoint32W (0x1001484)
		GetObjectW (0x1001488)
		LineTo (0x100148c)
		MoveToEx (0x1001490)
		ExtCreatePen (0x1001494)
		CreateCompatibleBitmap (0x1001498)
		CreateRectRgn (0x100149c)
		CreateRectRgnIndirect (0x10014a0)
		SetRectRgn (0x10014a4)
		CombineRgn (0x10014a8)
		SelectObject (0x10014ac)
		CreatePatternBrush (0x10014b0)
		SetTextColor (0x10014b4)
		SetBkMode (0x10014b8)
		GetStockObject (0x10014bc)
		SetBkColor (0x10014c0)
	KERNEL32.DLL			[ # imported functions: 88]
		lstrlenA (0x1001144)
		WideCharToMultiByte (0x1001148)
		GetStartupInfoA (0x100114c)
		OutputDebugStringA (0x1001150)
		SetUnhandledExceptionFilter (0x1001154)
		GetModuleHandleA (0x1001158)
		QueryPerformanceCounter (0x100115c)
		GetTickCount (0x1001160)
		GetCurrentThreadId (0x1001164)
		GetVersionExA (0x1001168)
		DeleteCriticalSection (0x100116c)
		InitializeCriticalSection (0x1001170)
		LeaveCriticalSection (0x1001174)
		EnterCriticalSection (0x1001178)
		GetCurrentProcessId (0x100117c)
		SizeofResource (0x1001180)
		LockResource (0x1001184)
		LoadResource (0x1001188)
		FindResourceW (0x100118c)
		FindResourceExW (0x1001190)
		GetModuleHandleW (0x1001194)
		GetSystemTime (0x1001198)
		SetEvent (0x100119c)
		CloseHandle (0x10011a0)
		WaitForSingleObject (0x10011a4)
		CreateThread (0x10011a8)
		CreateEventW (0x10011ac)
		ResetEvent (0x10011b0)
		lstrcmpW (0x10011b4)
		GlobalAlloc (0x10011b8)
		GlobalUnlock (0x10011bc)
		GlobalLock (0x10011c0)
		GlobalSize (0x10011c4)
		MulDiv (0x10011c8)
		GlobalFindAtomW (0x10011cc)
		GetLastError (0x10011d0)
		InterlockedDecrement (0x10011d4)
		MultiByteToWideChar (0x10011d8)
		GetLocalTime (0x10011dc)
		GetLocaleInfoW (0x10011e0)
		GetDateFormatW (0x10011e4)
		InterlockedIncrement (0x10011e8)
		WritePrivateProfileStringW (0x10011ec)
		GetPrivateProfileStringW (0x10011f0)
		lstrcmpiW (0x10011f4)
		GetLocaleInfoEx (0x10011f8)
		GetProcAddress (0x10011fc)
		LoadLibraryW (0x1001200)
		FreeLibrary (0x1001204)
		DelayLoadFailureHook (0x1001208)
		InterlockedCompareExchange (0x100120c)
		LoadLibraryExA (0x1001210)
		HeapFree (0x1001214)
		HeapAlloc (0x1001218)
		GetProcessHeap (0x100121c)
		GetVersionExW (0x1001220)
		InterlockedExchange (0x1001224)
		FreeLibraryAndExitThread (0x1001228)
		GetFileAttributesW (0x100122c)
		Wow64RevertWow64FsRedirection (0x1001230)
		Wow64DisableWow64FsRedirection (0x1001234)
		IsWow64Process (0x1001238)
		GetCurrentProcess (0x100123c)
		GetModuleFileNameW (0x1001240)
		LocalFree (0x1001244)
		LocalReAlloc (0x1001248)
		LocalAlloc (0x100124c)
		GetProfileStringW (0x1001250)
		lstrlenW (0x1001254)
		CompareStringW (0x1001258)
		ApplicationRecoveryInProgress (0x100125c)
		Sleep (0x1001260)
		ApplicationRecoveryFinished (0x1001264)
		RegisterApplicationRecoveryCallback (0x1001268)
		RegisterApplicationRestart (0x100126c)
		CompareFileTime (0x1001270)
		SystemTimeToFileTime (0x1001274)
		GetTempFileNameW (0x1001278)
		FileTimeToSystemTime (0x100127c)
		DeleteFileW (0x1001280)
		CreateFileW (0x1001284)
		GetSystemTimeAsFileTime (0x1001288)
		TerminateProcess (0x100128c)
		UnhandledExceptionFilter (0x1001290)
		HeapDestroy (0x1001294)
		HeapReAlloc (0x1001298)
		HeapSize (0x100129c)
		RaiseException (0x10012a0)
	MSVCRT.DLL			[ # imported functions: 89]
		wcsncmp (0x10014c8)
		_wcsnicmp (0x10014cc)
		iswdigit (0x10014d0)
		_wcslwr_s (0x10014d4)
		iswalpha (0x10014d8)
		??0bad_cast@@QAE@ABV0@@Z (0x10014dc)
		??1bad_cast@@UAE@XZ (0x10014e0)
		localeconv (0x10014e4)
		memchr (0x10014e8)
		strcspn (0x10014ec)
		sprintf_s (0x10014f0)
		_strtoi64 (0x10014f4)
		_strtoui64 (0x10014f8)
		_wcsdup (0x10014fc)
		_i64tow_s (0x1001500)
		_wtoi64 (0x1001504)
		wcsrchr (0x1001508)
		wcstoul (0x100150c)
		isalpha (0x1001510)
		time (0x1001514)
		difftime (0x1001518)
		memmove (0x100151c)
		_callnewh (0x1001520)
		__pctype_func (0x1001524)
		___lc_codepage_func (0x1001528)
		___lc_handle_func (0x100152c)
		_itow_s (0x1001530)
		___mb_cur_max_func (0x1001534)
		setlocale (0x1001538)
		__crtGetStringTypeW (0x100153c)
		__crtLCMapStringW (0x1001540)
		__mb_cur_max (0x1001544)
		tolower (0x1001548)
		isspace (0x100154c)
		abort (0x1001550)
		isalnum (0x1001554)
		__getmainargs (0x1001558)
		_cexit (0x100155c)
		_exit (0x1001560)
		_XcptFilter (0x1001564)
		_ismbblead (0x1001568)
		_acmdln (0x100156c)
		_initterm (0x1001570)
		_amsg_exit (0x1001574)
		__setusermatherr (0x1001578)
		__p__commode (0x100157c)
		__p__fmode (0x1001580)
		__set_app_type (0x1001584)
		??1type_info@@UAE@XZ (0x1001588)
		_unlock (0x100158c)
		__dllonexit (0x1001590)
		_lock (0x1001594)
		_onexit (0x1001598)
		?terminate@@YAXXZ (0x100159c)
		__uncaught_exception (0x10015a0)
		_except_handler4_common (0x10015a4)
		_controlfp (0x10015a8)
		_wtoi (0x10015ac)
		_itoa (0x10015b0)
		calloc (0x10015b4)
		wcschr (0x10015b8)
		_wcsicmp (0x10015bc)
		_vsnwprintf (0x10015c0)
		memcpy (0x10015c4)
		wcscat_s (0x10015c8)
		wcstol (0x10015cc)
		wcscpy_s (0x10015d0)
		exit (0x10015d4)
		mbstowcs_s (0x10015d8)
		toupper (0x10015dc)
		isxdigit (0x10015e0)
		isdigit (0x10015e4)
		_ftol2_sse (0x10015e8)
		memset (0x10015ec)
		_ftol2 (0x10015f0)
		malloc (0x10015f4)
		_purecall (0x10015f8)
		free (0x10015fc)
		??0exception@@QAE@XZ (0x1001600)
		_CxxThrowException (0x1001604)
		??0exception@@QAE@ABV0@@Z (0x1001608)
		??1exception@@UAE@XZ (0x100160c)
		?what@exception@@UBEPBDXZ (0x1001610)
		??0exception@@QAE@ABQBD@Z (0x1001614)
		memmove_s (0x1001618)
		memcpy_s (0x100161c)
		__CxxFrameHandler3 (0x1001620)
		_errno (0x1001624)
		_wcsrev (0x1001628)
	NTDLL.DLL			[ # imported functions: 05]
		WinSqmAddToStreamEx (0x100112c)
		WinSqmIncrementDWORD (0x1001130)
		WinSqmAddToStream (0x1001134)
		NtQueryLicenseValue (0x1001138)
		RtlInitUnicodeString (0x100113c)
	OLEAUT32.DLL			[ # imported functions: 06]
		SysAllocString (0x10010d0)
		SysStringLen (0x10010d4)
		VariantInit (0x10010d8)
		SysAllocStringByteLen (0x10010dc)
		SysFreeString (0x10010e0)
		VariantClear (0x10010e4)
	OLE32.DLL			[ # imported functions: 03]
		CoInitialize (0x10010f4)
		CoUninitialize (0x10010f8)
		CoCreateInstance (0x10010fc)
	RPCRT4.DLL			[ # imported functions: 03]
		UuidCreate (0x1001430)
		UuidToStringW (0x1001434)
		RpcStringFreeW (0x1001438)
	SHELL32.DLL			[ # imported functions: 05]
		SHGetSpecialFolderPathW (0x1001000)
		SHGetFolderPathW (0x1001004)
		ShellAboutW (0x1001008)
		None (0x100100c)
		ShellExecuteExW (0x1001010)
	SHLWAPI.DLL			[ # imported functions: 01]
		None (0x1001018)
	UXTHEME.DLL			[ # imported functions: 01]
		IsThemeActive (0x10010ec)
	USER32.DLL			[ # imported functions: 97]
		GetSysColor (0x10012a8)
		SetClassLongW (0x10012ac)
		GetClassLongW (0x10012b0)
		DrawMenuBar (0x10012b4)
		SetMenuItemInfoW (0x10012b8)
		AppendMenuW (0x10012bc)
		RemoveMenu (0x10012c0)
		GetSubMenu (0x10012c4)
		GetWindowLongW (0x10012c8)
		InsertMenuItemW (0x10012cc)
		SetWindowLongW (0x10012d0)
		IsWindowEnabled (0x10012d4)
		PostMessageW (0x10012d8)
		CharNextA (0x10012dc)
		SetClipboardData (0x10012e0)
		EmptyClipboard (0x10012e4)
		CloseClipboard (0x10012e8)
		GetClipboardData (0x10012ec)
		OpenClipboard (0x10012f0)
		GetMenuState (0x10012f4)
		IsClipboardFormatAvailable (0x10012f8)
		DefWindowProcW (0x10012fc)
		InvalidateRect (0x1001300)
		PostQuitMessage (0x1001304)
		GetFocus (0x1001308)
		DispatchMessageW (0x100130c)
		TranslateMessage (0x1001310)
		GetMessageExtraInfo (0x1001314)
		TranslateAcceleratorW (0x1001318)
		GetMessageW (0x100131c)
		SetForegroundWindow (0x1001320)
		SetWindowPlacement (0x1001324)
		RegisterClassExW (0x1001328)
		DrawTextW (0x100132c)
		ReleaseDC (0x1001330)
		GetDC (0x1001334)
		GetSystemMetrics (0x1001338)
		EnumChildWindows (0x100133c)
		SetPropW (0x1001340)
		GetMenu (0x1001344)
		CheckRadioButton (0x1001348)
		UpdateWindow (0x100134c)
		SendDlgItemMessageW (0x1001350)
		IsDlgButtonChecked (0x1001354)
		MoveWindow (0x1001358)
		GetDlgItemInt (0x100135c)
		SetDlgItemInt (0x1001360)
		CheckMenuItem (0x1001364)
		GetNextDlgTabItem (0x1001368)
		OffsetRect (0x100136c)
		GetMonitorInfoW (0x1001370)
		MonitorFromWindow (0x1001374)
		CopyRect (0x1001378)
		IntersectRect (0x100137c)
		EnumDisplayMonitors (0x1001380)
		EqualRect (0x1001384)
		MonitorFromRect (0x1001388)
		GetClassWord (0x100138c)
		EnumDesktopWindows (0x1001390)
		GetProcessDefaultLayout (0x1001394)
		CreateDialogParamW (0x1001398)
		TrackPopupMenu (0x100139c)
		CreatePopupMenu (0x10013a0)
		GetAncestor (0x10013a4)
		FindWindowW (0x10013a8)
		EndDialog (0x10013ac)
		EnableMenuItem (0x10013b0)
		DestroyWindow (0x10013b4)
		MapWindowPoints (0x10013b8)
		GetClassNameW (0x10013bc)
		GetDlgItem (0x10013c0)
		GetWindowRect (0x10013c4)
		SetWindowPos (0x10013c8)
		SendMessageW (0x10013cc)
		LoadCursorW (0x10013d0)
		SetCursor (0x10013d4)
		GetKeyState (0x10013d8)
		IsDialogMessageW (0x10013dc)
		LoadAcceleratorsW (0x10013e0)
		GetWindowTextLengthW (0x10013e4)
		GetWindowTextW (0x10013e8)
		EnableWindow (0x10013ec)
		SetFocus (0x10013f0)
		LoadStringW (0x10013f4)
		SetWindowTextW (0x10013f8)
		GetParent (0x10013fc)
		GetClientRect (0x1001400)
		ShowWindow (0x1001404)
		GetWindowPlacement (0x1001408)
		LoadImageW (0x100140c)
		UnregisterClassA (0x1001410)
		FillRect (0x1001414)
		CheckMenuRadioItem (0x1001418)
		CreateWindowExW (0x100141c)
		MessageBeep (0x1001420)
		SystemParametersInfoW (0x1001424)
		DialogBoxParamW (0x1001428)
	VERSION.DLL			[ # imported functions: 03]
		GetFileVersionInfoExW (0x1001448)
		GetFileVersionInfoSizeExW (0x100144c)
		VerQueryValueW (0x1001450)
	WINMM.DLL			[ # imported functions: 01]
		timeGetTime (0x1001440)

About

A similar Linux ldd command for EXE files... for DLL hijacking prevention or exploitation

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%