Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call some of them just as if Windows does. How could one do this?
I guess I would need to know what the function names are, and how to call the functions by their names, and what parameters to pass.
TL;DR you can call anything, locating the right part of code is the hard part.
If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation.
If you actually mean 'all the functions, including the internal ones', then you need to disassemble and tell the difference from code and data. in this case, your best bet is to open the files in IDA - with symbols preferrably - and export the function list.
If you want to do that manually, then you need your own smart disassembler, which is far from trivial: sometimes, compilers generate some code that doesn't immediately look like parts of a function.
Once you've located the functions, you can just call them directly, without the need of injection, but you have to make sure you have the exact same version of the DLL. hard_imports use such a method to call pieces of code directly.
GetProcAddress, needs either an exported name or ordinal value.