在 C++ 中查找外部调用动态链接库
目前，我们针对与之交互的特定硬件使用硬件驱动程序的 DLL。然而，我们还有一个 2002 年左右用 VC++ 编写的旧的内部开发的 DLL，它包装了该 DLL 的一些核心函数。这段代码早已丢失，并且在我出现之前就已经开发好了。因此，在失败的情况下，它无法被支持，甚至无法被查看。我们试图通过直接从 C#.NET 应用程序访问驱动程序来消除中间人。
我确实知道这个 DLL 只是包装了硬件供应商的 DLL，但方法签名不相等。看起来它正在单个方法中调用多个驱动程序函数。我的问题是：我如何才能查看此包装器 DLL 对该特定函数的驱动程序 DLL 进行的所有外部调用？我不关心任何其他代码；我相当确定，如果我能弄清楚它向司机拨打的电话，我就可以推断出这一点。
编辑：更简洁的解释（已编造）...
Driver.dll 有一个名为 StartAcquisition(int, string) 的函数。它还具有多种设置功能。
Wrapper.dll 有一个名为 StartAcquisition(int, string, double, int) 的函数。
我怀疑 Wrapper.dll 除了一些其他调用（可能是那些设置）之外，还在调用 Driver.dll 的 StartAcquisition(int, string)功能）。我想知道其他电话可能是什么。
We currently use a hardware driver's DLL for a particular piece of hardware we interface with. However, we also have an old internally developed DLL written with VC++ around 2002 that wraps that DLL for a few core functions. This code has been long lost, and was developed well before I came on the scene. So, it cannot be supported or even viewed in the case of a failure. We're trying to cut out the middleman by accessing the driver directly from our C#.NET application.
I do know this DLL simply wraps the hardware vendor's DLL, but the method signatures do not equal up. It looks like it is calling multiple driver functions in the single method. My question is this: how would I be able to view all the external calls this wrapper DLL is making to the driver DLL for this particular function? I'm not concerned about any of the other code; I'm fairly certain I can deduce that if I can just figure out the calls it's making to the driver.
Edit: A more concise explanation (that is made up)...
Driver.dll has a function called StartAcquisition(int, string). It also has a variety of setup functions.
Wrapper.dll has a function called StartAcquisition(int, string, double, int).
I suspect Wrapper.dll is calling Driver.dll's StartAcquisition(int, string) in addition to a few other calls (likely those setup functions). I want to know what those other calls could be.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我认为 PE.Explorer 可能会帮助您。
即使它没有直接列出，您仍然可以进行反汇编并检查导入表映射。也许可以将此工具与另一个工具配对，例如 Windbg 或 OllyDbg 你可能会得到有趣的结果。
任何可以帮助您的工具都必须处理反汇编。使用当前的可移植可执行格式 (PE)，有明确的导入/导出部分。要使用代码映射这些表需要某种解释，这就是为什么我认为不存在立即执行此操作的工具。
I think that PE.Explorer might help you.
Even if it doesn't list it directly, you can still get the dissassembly and check for import tables mapping. Maybe by pairing this tool with another one like Windbg or OllyDbg you might get interesting results.
Any tool that can help you WILL have to deal with dissassembly. With the current Portable Executable format (PE), there are explicit sections for imports/exports. To map these tables with code needs some kind of interpretation, that's why I don't think a tool that does it straight away exists.
您可以尝试像 IDA Pro 这样的反汇编程序（http://www.hex-rays.com/idapro/ ）。
You could try a disassembler like IDA Pro (http://www.hex-rays.com/idapro/).
看起来您必须构建自己的小实用程序来查找和反汇编现有程序，然后使用您最喜欢的实用程序扫描输出文本并搜索您的调用。我希望您不必这样做，但这可能比找到已经做到这一点的实用程序更快。
It looks like you will have to build your own little utility to find and disassemble existing programs, and then use your favorite utility to scan the output text and search for your call. I hope you don't have to, but it might be faster than finding an utility that already does that.
如果您有权访问供应商 DLL 的接口，则可以构建自己的模拟替换库并将其放入路径中，以便旧版 DLL 可以使用它。
模拟库不会执行任何操作，只是报告何时调用任何导出以及何时调用。
If you have access to the interface of the vendor DLL, you could build your own mock replacement library and put it in the path so the legacy DLL come to use it.
The mock library would do nothing and just report when any of the exports was called and when.