ynkdir/mydumpbin.c

## mydumpbin.c
// mydumpbin.c
//
// Reference:
// http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx
// http://forums.belution.com/ja/vc/000/234/78s.shtml
// http://nienie.com/~masapico/api_ImageDirectoryEntryToData.html
// http://www.geocities.jp/i96815/windows/win09.html
// http://hp.vector.co.jp/authors/VA050396/index.html

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

#define TO_DOS_HEADER(base) ((PIMAGE_DOS_HEADER)(base))
#define TO_NT_HEADERS(base) ((PIMAGE_NT_HEADERS)((LPBYTE)(base) + TO_DOS_HEADER(base)->e_lfanew))

/* VC8/include/delayimp.h */
#if !defined(_DELAY_IMP_VER)
typedef DWORD                       RVA;

typedef struct ImgDelayDescr {
    DWORD           grAttrs;        // attributes
    RVA             rvaDLLName;     // RVA to dll name
    RVA             rvaHmod;        // RVA of module handle
    RVA             rvaIAT;         // RVA of the IAT
    RVA             rvaINT;         // RVA of the INT
    RVA             rvaBoundIAT;    // RVA of the optional bound IAT
    RVA             rvaUnloadIAT;   // RVA of optional copy of original IAT
    DWORD           dwTimeStamp;    // 0 if not bound,
                                    // O.W. date/time stamp of DLL bound to (Old BIND)
} ImgDelayDescr, * PImgDelayDescr;

enum DLAttr {                   // Delay Load Attributes
    dlattrRva = 0x1,                // RVAs are used instead of pointers
                                    // Having this set indicates a VC7.0
                                    // and above delay load descriptor.
};
#endif

static size_t fgetsize(FILE *f);
static int read_file(const char *path, char **pbuf, size_t *psize);
static DWORD_PTR load_library(const char *modulepath);
static PVOID MyImageDirectoryEntryToData(LPVOID Base, BOOLEAN MappedAsImage, USHORT DirectoryEntry, PULONG Size);
static DWORD_PTR load_module(const char *modulepath);
static void dump_dependents(DWORD_PTR Base);
static void dump_imports(DWORD_PTR Base);
static void dump_bound_imports(DWORD_PTR Base);
static void dump_delay_imports(DWORD_PTR Base);
static void dump_exports(DWORD_PTR Base);

    static size_t
fgetsize(FILE *f)
{
    fpos_t cur;
    fpos_t end;

    if (fgetpos(f, &cur) != 0)
        return (size_t)-1;

    if (fseek(f, 0L, SEEK_END) != 0)
        return (size_t)-1;

    if (fgetpos(f, &end) != 0)
        return (size_t)-1;

    if (fsetpos(f, &cur) != 0)
        return (size_t)-1;

    return (size_t)end;
}

    static int
read_file(const char *path, char **pbuf, size_t *psize)
{
    FILE *f;
    size_t size;
    char *buf;

    f = fopen(path, "rb");
    if (f == NULL)
        return -1;

    size = fgetsize(f);
    if (size == (size_t)-1) {
        fclose(f);
        return -1;
    }

    buf = malloc(size);
    if (buf == NULL) {
        fclose(f);
        return -1;
    }

    if (fread(buf, 1, size, f) != size) {
        fclose(f);
        free(buf);
        return -1;
    }

    fclose(f);

    *pbuf = buf;
    *psize = size;

    return 0;
}

    static DWORD_PTR
load_library(const char *modulepath)
{
    char *p;
    char *base;
    size_t size;
    PIMAGE_DOS_HEADER pdos;
    PIMAGE_NT_HEADERS pnt;
    PIMAGE_SECTION_HEADER psec;
    DWORD i;

    if (read_file(modulepath, &p, &size) != 0)
        return 0;

    // check dos header
    pdos = TO_DOS_HEADER(p);
    if (pdos->e_magic != IMAGE_DOS_SIGNATURE || pdos->e_lfanew == 0) {
        free(p);
        return 0; // not executable file
    }

    // check nt header
    pnt = TO_NT_HEADERS(p);
    if (pnt->Signature != IMAGE_NT_SIGNATURE
            || pnt->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC) {
        free(p);
        return 0; // not PE file
    }

    // get section table
    psec = (PIMAGE_SECTION_HEADER)(pnt + 1);

    base = malloc(pnt->OptionalHeader.SizeOfImage);
    if (base == NULL) {
        free(p);
        return 0;
    }

    // copy header
    memcpy(base, p, pnt->OptionalHeader.SizeOfHeaders);
    // copy section data
    for (i = 0; i < pnt->FileHeader.NumberOfSections; i++) {
        if (psec[i].PointerToRawData) {
            memcpy(&base[psec[i].VirtualAddress],
                    &p[psec[i].PointerToRawData],
                    psec[i].SizeOfRawData);
        }
    }

    free(p);

    return (DWORD_PTR)base;
}

/*
 * The formal way is
 *   imagehlp.h or dbghelp.h
 *   imagehlp.lib or dbghelp.lib
 *   ImageDirectoryEntryToData()
 *
 * Size is whole data size (including dll name buffer, for example). It is not
 * size of result pointer.
 * If result is array, last one is zero filled as sentinel.
 */
    static PVOID
MyImageDirectoryEntryToData(LPVOID Base, BOOLEAN MappedAsImage, USHORT DirectoryEntry, PULONG Size)
{
    /* TODO: MappedAsImage? */
    PIMAGE_DATA_DIRECTORY p;
    p = TO_NT_HEADERS(Base)->OptionalHeader.DataDirectory + DirectoryEntry;
    if (p->VirtualAddress == 0) {
        *Size = 0;
        return NULL;
    }
    *Size = p->Size;
    return (PVOID)((LPBYTE)Base + p->VirtualAddress);
}

    static DWORD_PTR
load_module(const char *modulepath)
{
    DWORD_PTR Base;

    printf("Dump of file %s\n", modulepath);
    printf("\n");

    //Base = (DWORD_PTR)LoadLibrary(modulepath);
    Base = load_library(modulepath);
    if (Base == 0) {
        printf("fatal error: cannot open '%s'\n", modulepath);
        exit(1);
    }

    if (TO_NT_HEADERS(Base)->FileHeader.Characteristics & IMAGE_FILE_DLL)
        printf("File Type: DLL\n");
    else
        printf("File Type: EXECUTABLE IMAGE\n");
    printf("\n");

    return Base;
}

    static void
dump_dependents(DWORD_PTR Base)
{
    ULONG Size;
    PIMAGE_IMPORT_DESCRIPTOR Imp;

    Imp = MyImageDirectoryEntryToData(
            (LPVOID)Base,
            TRUE,
            IMAGE_DIRECTORY_ENTRY_IMPORT,
            &Size);
    if (Imp == NULL)
        return;

    printf("  Image has the following dependencies:\n");
    printf("\n");
    for ( ; Imp->OriginalFirstThunk != 0; ++Imp)
        printf("    %s\n", (char *)Base + Imp->Name);
    printf("\n");
}

    static void
dump_imports(DWORD_PTR Base)
{
    ULONG Size;
    PIMAGE_IMPORT_DESCRIPTOR Imp;
    PIMAGE_THUNK_DATA Name;         /* Import Name Table */
    PIMAGE_THUNK_DATA Addr;         /* Import Address Table */
    PIMAGE_IMPORT_BY_NAME ImpName;

    Imp = MyImageDirectoryEntryToData(
            (LPVOID)Base,
            TRUE,
            IMAGE_DIRECTORY_ENTRY_IMPORT,
            &Size);
    if (Imp == NULL)
        return;

    printf("  Section contains the following imports:\n");
    printf("\n");
    for ( ; Imp->OriginalFirstThunk != 0; ++Imp) {
        Addr = (PIMAGE_THUNK_DATA)(Base + Imp->FirstThunk);
        Name = (PIMAGE_THUNK_DATA)(Base + Imp->OriginalFirstThunk);
        printf("    %s\n", (char *)Base + Imp->Name);
        printf("              %08zX Import Address Table\n", (DWORD_PTR)Addr);
        printf("              %08zX Import Name Table\n", (DWORD_PTR)Name);
        printf("              %8X time date stamp\n", Imp->TimeDateStamp);
        printf("              %08X Index of first forwarder reference\n", Imp->ForwarderChain);
        printf("\n");
        for ( ; Addr->u1.Function != 0; ++Addr, ++Name) {
            if (IMAGE_SNAP_BY_ORDINAL(Name->u1.Ordinal)) {
                printf("      %08zX        Ordinal   %zd\n", Addr->u1.Function, IMAGE_ORDINAL(Name->u1.Ordinal));
            } else {
                ImpName = (PIMAGE_IMPORT_BY_NAME)(Base + Name->u1.AddressOfData);
                printf("      %08zX %6X %s\n", Addr->u1.Function, ImpName->Hint, ImpName->Name);
            }
        }
        printf("\n");
    }
}

    static void
dump_bound_imports(DWORD_PTR Base)
{
    ULONG Size;
    PIMAGE_BOUND_IMPORT_DESCRIPTOR BoundBase;
    PIMAGE_BOUND_IMPORT_DESCRIPTOR Bound;
    int i;

    BoundBase = MyImageDirectoryEntryToData(
            (LPVOID)Base,
            TRUE,
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT,
            &Size);
    if (BoundBase == NULL)
        return;

    printf("Header contains the following bound import information:\n");
    for (Bound = BoundBase ; Bound->TimeDateStamp != 0; ++Bound) {
        printf("    Bound to %s [%8X] %s",
                (LPBYTE)BoundBase + Bound->OffsetModuleName,
                Bound->TimeDateStamp,
                ctime((time_t *)&Bound->TimeDateStamp));
        if (Bound->NumberOfModuleForwarderRefs != 0) {
            for (i = Bound->NumberOfModuleForwarderRefs; i != 0; --i) {
                ++Bound;
                printf("      Contained forwarders bound to %s [%8X] %s",
                        (LPBYTE)BoundBase + Bound->OffsetModuleName,
                        Bound->TimeDateStamp,
                        ctime((time_t *)&Bound->TimeDateStamp));
            }
        }
    }
    printf("\n");
}

    static void
dump_delay_imports(DWORD_PTR Base)
{
    ULONG Size;
    PImgDelayDescr Delay;
    PIMAGE_THUNK_DATA Name;         /* Import Name Table */
    PIMAGE_THUNK_DATA Addr;         /* Import Address Table */
    PIMAGE_IMPORT_BY_NAME ImpName;

    Delay = MyImageDirectoryEntryToData(
            (LPVOID)Base,
            TRUE,
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT,
            &Size);
    if (Delay == NULL)
        return;

    printf("Section contains the following delay load imports:\n");
    printf("\n");
    for ( ; Delay->rvaHmod != 0; ++Delay) {
        printf("    %s\n", (char *)Base + Delay->rvaDLLName);
        printf("              %08X Characteristics\n", Delay->grAttrs);
        printf("              %08zX Address of HMODULE\n", Base + Delay->rvaHmod);
        printf("              %08zX Import Address Table\n", Base + Delay->rvaIAT);
        printf("              %08zX Import Name Table\n", Base + Delay->rvaINT);
        printf("              %08zX Bound Import Name Table\n",
                (Delay->rvaBoundIAT == 0) ? 0 : Base + Delay->rvaBoundIAT);
        printf("              %08zX Unload Import Name Table\n",
                (Delay->rvaUnloadIAT == 0) ? 0 : Base + Delay->rvaUnloadIAT);
        printf("              %8X time date stamp\n", Delay->dwTimeStamp);
        printf("\n");
        Addr = (PIMAGE_THUNK_DATA)(Base + Delay->rvaIAT);
        Name = (PIMAGE_THUNK_DATA)(Base + Delay->rvaINT);
        for ( ; Addr->u1.Function != 0; ++Addr, ++Name) {
            if (IMAGE_SNAP_BY_ORDINAL(Name->u1.Ordinal)) {
                printf("          %08zX                 Ordinal   %zd\n", Addr->u1.Function, IMAGE_ORDINAL(Name->u1.Ordinal));
            } else {
                ImpName = (PIMAGE_IMPORT_BY_NAME)(Base + Name->u1.AddressOfData);
                printf("          %08zX        %8X %s\n", Addr->u1.Function, ImpName->Hint, ImpName->Name);
            }
        }
        printf("\n");
    }
    printf("\n");
}

    static void
dump_exports(DWORD_PTR Base)
{
    ULONG Size;
    PIMAGE_EXPORT_DIRECTORY Exp;
    WORD *Ordinal;
    DWORD *Addr;
    DWORD *Name;
    DWORD hint;
    char buf[32];

    Exp = MyImageDirectoryEntryToData(
            (LPVOID)Base,
            TRUE,
            IMAGE_DIRECTORY_ENTRY_EXPORT,
            &Size);
    if (Exp == NULL)
        return;

    printf("  Section contains the following exports for %s\n", (char *)Base + Exp->Name);
    printf("\n");
    printf("    %08X characteristics\n", Exp->Characteristics);
    printf("    %8X time date stamp %s", Exp->TimeDateStamp, ctime((time_t *)(&Exp->TimeDateStamp)));
    sprintf(buf, "%d.%02d", Exp->MajorVersion, Exp->MinorVersion);
    printf("    %8s version\n", buf);
    printf("    %8d ordinal base\n", Exp->Base);
    printf("    %8d number of functions\n", Exp->NumberOfFunctions);
    printf("    %8d number of names\n", Exp->NumberOfNames);
    printf("\n");
    printf("    ordinal hint RVA      name\n");
    printf("\n");
    Ordinal = (WORD *)(Base + Exp->AddressOfNameOrdinals);
    Addr = (DWORD *)(Base + Exp->AddressOfFunctions);
    Name = (DWORD *)(Base + Exp->AddressOfNames);
    for (hint = 0; hint < Exp->NumberOfNames; ++hint) {
        printf("    %7d %4X %08X %s\n",
                Exp->Base + Ordinal[hint],
                hint,
                Addr[Ordinal[hint]],
                (char *)Base + Name[hint]);
    }
}

    int
main(int argc, char **argv)
{
    DWORD_PTR Base;
    if (argc == 3 && _stricmp(argv[1] + 1, "DEPENDENTS") == 0) {
        Base = load_module(argv[2]);
        dump_dependents(Base);
    } else if (argc == 3 && _stricmp(argv[1] + 1, "EXPORTS") == 0) {
        Base = load_module(argv[2]);
        dump_exports(Base);
    } else if (argc == 3 && _stricmp(argv[1] + 1, "IMPORTS") == 0) {
        Base = load_module(argv[2]);
        dump_imports(Base);
        dump_bound_imports(Base);
        dump_delay_imports(Base);
    } else {
        printf("usage: %s [option] [file]\n", argv[0]);
        printf("\n");
        printf("      /DEPENDENTS\n");
        printf("      /EXPORTS\n");
        printf("      /IMPORTS\n");
    }
    return 0;
}
	// mydumpbin.c
	//
	// Reference:
	// http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx
	// http://forums.belution.com/ja/vc/000/234/78s.shtml
	// http://nienie.com/~masapico/api_ImageDirectoryEntryToData.html
	// http://www.geocities.jp/i96815/windows/win09.html
	// http://hp.vector.co.jp/authors/VA050396/index.html

	#include <windows.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <time.h>

	#define TO_DOS_HEADER(base) ((PIMAGE_DOS_HEADER)(base))
	#define TO_NT_HEADERS(base) ((PIMAGE_NT_HEADERS)((LPBYTE)(base) + TO_DOS_HEADER(base)->e_lfanew))

	/* VC8/include/delayimp.h */
	#if !defined(_DELAY_IMP_VER)
	typedef DWORD RVA;

	typedef struct ImgDelayDescr {
	DWORD grAttrs; // attributes
	RVA rvaDLLName; // RVA to dll name
	RVA rvaHmod; // RVA of module handle
	RVA rvaIAT; // RVA of the IAT
	RVA rvaINT; // RVA of the INT
	RVA rvaBoundIAT; // RVA of the optional bound IAT
	RVA rvaUnloadIAT; // RVA of optional copy of original IAT
	DWORD dwTimeStamp; // 0 if not bound,
	// O.W. date/time stamp of DLL bound to (Old BIND)
	} ImgDelayDescr, * PImgDelayDescr;

	enum DLAttr { // Delay Load Attributes
	dlattrRva = 0x1, // RVAs are used instead of pointers
	// Having this set indicates a VC7.0
	// and above delay load descriptor.
	};
	#endif

	static size_t fgetsize(FILE *f);
	static int read_file(const char path, char pbuf, size_t psize);
	static DWORD_PTR load_library(const char *modulepath);
	static PVOID MyImageDirectoryEntryToData(LPVOID Base, BOOLEAN MappedAsImage, USHORT DirectoryEntry, PULONG Size);
	static DWORD_PTR load_module(const char *modulepath);
	static void dump_dependents(DWORD_PTR Base);
	static void dump_imports(DWORD_PTR Base);
	static void dump_bound_imports(DWORD_PTR Base);
	static void dump_delay_imports(DWORD_PTR Base);
	static void dump_exports(DWORD_PTR Base);

	static size_t
	fgetsize(FILE *f)
	{
	fpos_t cur;
	fpos_t end;

	if (fgetpos(f, &cur) != 0)
	return (size_t)-1;

	if (fseek(f, 0L, SEEK_END) != 0)
	return (size_t)-1;

	if (fgetpos(f, &end) != 0)
	return (size_t)-1;

	if (fsetpos(f, &cur) != 0)
	return (size_t)-1;

	return (size_t)end;
	}

	static int
	read_file(const char path, char pbuf, size_t psize)
	{
	FILE *f;
	size_t size;
	char *buf;

	f = fopen(path, "rb");
	if (f == NULL)
	return -1;

	size = fgetsize(f);
	if (size == (size_t)-1) {
	fclose(f);
	return -1;
	}

	buf = malloc(size);
	if (buf == NULL) {
	fclose(f);
	return -1;
	}

	if (fread(buf, 1, size, f) != size) {
	fclose(f);
	free(buf);
	return -1;
	}

	fclose(f);

	*pbuf = buf;
	*psize = size;

	return 0;
	}

	static DWORD_PTR
	load_library(const char *modulepath)
	{
	char *p;
	char *base;
	size_t size;
	PIMAGE_DOS_HEADER pdos;
	PIMAGE_NT_HEADERS pnt;
	PIMAGE_SECTION_HEADER psec;
	DWORD i;

	if (read_file(modulepath, &p, &size) != 0)
	return 0;

	// check dos header
	pdos = TO_DOS_HEADER(p);
	if (pdos->e_magic != IMAGE_DOS_SIGNATURE \|\| pdos->e_lfanew == 0) {
	free(p);
	return 0; // not executable file
	}

	// check nt header
	pnt = TO_NT_HEADERS(p);
	if (pnt->Signature != IMAGE_NT_SIGNATURE
	\|\| pnt->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC) {
	free(p);
	return 0; // not PE file
	}

	// get section table
	psec = (PIMAGE_SECTION_HEADER)(pnt + 1);

	base = malloc(pnt->OptionalHeader.SizeOfImage);
	if (base == NULL) {
	free(p);
	return 0;
	}

	// copy header
	memcpy(base, p, pnt->OptionalHeader.SizeOfHeaders);
	// copy section data
	for (i = 0; i < pnt->FileHeader.NumberOfSections; i++) {
	if (psec[i].PointerToRawData) {
	memcpy(&base[psec[i].VirtualAddress],
	&p[psec[i].PointerToRawData],
	psec[i].SizeOfRawData);
	}
	}

	free(p);

	return (DWORD_PTR)base;
	}

	/*
	* The formal way is
	* imagehlp.h or dbghelp.h
	* imagehlp.lib or dbghelp.lib
	* ImageDirectoryEntryToData()
	*
	* Size is whole data size (including dll name buffer, for example). It is not
	* size of result pointer.
	* If result is array, last one is zero filled as sentinel.
	*/
	static PVOID
	MyImageDirectoryEntryToData(LPVOID Base, BOOLEAN MappedAsImage, USHORT DirectoryEntry, PULONG Size)
	{
	/* TODO: MappedAsImage? */
	PIMAGE_DATA_DIRECTORY p;
	p = TO_NT_HEADERS(Base)->OptionalHeader.DataDirectory + DirectoryEntry;
	if (p->VirtualAddress == 0) {
	*Size = 0;
	return NULL;
	}
	*Size = p->Size;
	return (PVOID)((LPBYTE)Base + p->VirtualAddress);
	}

	static DWORD_PTR
	load_module(const char *modulepath)
	{
	DWORD_PTR Base;

	printf("Dump of file %s\n", modulepath);
	printf("\n");

	//Base = (DWORD_PTR)LoadLibrary(modulepath);
	Base = load_library(modulepath);
	if (Base == 0) {
	printf("fatal error: cannot open '%s'\n", modulepath);
	exit(1);
	}

	if (TO_NT_HEADERS(Base)->FileHeader.Characteristics & IMAGE_FILE_DLL)
	printf("File Type: DLL\n");
	else
	printf("File Type: EXECUTABLE IMAGE\n");
	printf("\n");

	return Base;
	}

	static void
	dump_dependents(DWORD_PTR Base)
	{
	ULONG Size;
	PIMAGE_IMPORT_DESCRIPTOR Imp;

	Imp = MyImageDirectoryEntryToData(
	(LPVOID)Base,
	TRUE,
	IMAGE_DIRECTORY_ENTRY_IMPORT,
	&Size);
	if (Imp == NULL)
	return;

	printf(" Image has the following dependencies:\n");
	printf("\n");
	for ( ; Imp->OriginalFirstThunk != 0; ++Imp)
	printf(" %s\n", (char *)Base + Imp->Name);
	printf("\n");
	}

	static void
	dump_imports(DWORD_PTR Base)
	{
	ULONG Size;
	PIMAGE_IMPORT_DESCRIPTOR Imp;
	PIMAGE_THUNK_DATA Name; /* Import Name Table */
	PIMAGE_THUNK_DATA Addr; /* Import Address Table */
	PIMAGE_IMPORT_BY_NAME ImpName;

	Imp = MyImageDirectoryEntryToData(
	(LPVOID)Base,
	TRUE,
	IMAGE_DIRECTORY_ENTRY_IMPORT,
	&Size);
	if (Imp == NULL)
	return;

	printf(" Section contains the following imports:\n");
	printf("\n");
	for ( ; Imp->OriginalFirstThunk != 0; ++Imp) {
	Addr = (PIMAGE_THUNK_DATA)(Base + Imp->FirstThunk);
	Name = (PIMAGE_THUNK_DATA)(Base + Imp->OriginalFirstThunk);
	printf(" %s\n", (char *)Base + Imp->Name);
	printf(" %08zX Import Address Table\n", (DWORD_PTR)Addr);
	printf(" %08zX Import Name Table\n", (DWORD_PTR)Name);
	printf(" %8X time date stamp\n", Imp->TimeDateStamp);
	printf(" %08X Index of first forwarder reference\n", Imp->ForwarderChain);
	printf("\n");
	for ( ; Addr->u1.Function != 0; ++Addr, ++Name) {
	if (IMAGE_SNAP_BY_ORDINAL(Name->u1.Ordinal)) {
	printf(" %08zX Ordinal %zd\n", Addr->u1.Function, IMAGE_ORDINAL(Name->u1.Ordinal));
	} else {
	ImpName = (PIMAGE_IMPORT_BY_NAME)(Base + Name->u1.AddressOfData);
	printf(" %08zX %6X %s\n", Addr->u1.Function, ImpName->Hint, ImpName->Name);
	}
	}
	printf("\n");
	}
	}

	static void
	dump_bound_imports(DWORD_PTR Base)
	{
	ULONG Size;
	PIMAGE_BOUND_IMPORT_DESCRIPTOR BoundBase;
	PIMAGE_BOUND_IMPORT_DESCRIPTOR Bound;
	int i;

	BoundBase = MyImageDirectoryEntryToData(
	(LPVOID)Base,
	TRUE,
	IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT,
	&Size);
	if (BoundBase == NULL)
	return;

	printf("Header contains the following bound import information:\n");
	for (Bound = BoundBase ; Bound->TimeDateStamp != 0; ++Bound) {
	printf(" Bound to %s [%8X] %s",
	(LPBYTE)BoundBase + Bound->OffsetModuleName,
	Bound->TimeDateStamp,
	ctime((time_t *)&Bound->TimeDateStamp));
	if (Bound->NumberOfModuleForwarderRefs != 0) {
	for (i = Bound->NumberOfModuleForwarderRefs; i != 0; --i) {
	++Bound;
	printf(" Contained forwarders bound to %s [%8X] %s",
	(LPBYTE)BoundBase + Bound->OffsetModuleName,
	Bound->TimeDateStamp,
	ctime((time_t *)&Bound->TimeDateStamp));
	}
	}
	}
	printf("\n");
	}

	static void
	dump_delay_imports(DWORD_PTR Base)
	{
	ULONG Size;
	PImgDelayDescr Delay;
	PIMAGE_THUNK_DATA Name; /* Import Name Table */
	PIMAGE_THUNK_DATA Addr; /* Import Address Table */
	PIMAGE_IMPORT_BY_NAME ImpName;

	Delay = MyImageDirectoryEntryToData(
	(LPVOID)Base,
	TRUE,
	IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT,
	&Size);
	if (Delay == NULL)
	return;

	printf("Section contains the following delay load imports:\n");
	printf("\n");
	for ( ; Delay->rvaHmod != 0; ++Delay) {
	printf(" %s\n", (char *)Base + Delay->rvaDLLName);
	printf(" %08X Characteristics\n", Delay->grAttrs);
	printf(" %08zX Address of HMODULE\n", Base + Delay->rvaHmod);
	printf(" %08zX Import Address Table\n", Base + Delay->rvaIAT);
	printf(" %08zX Import Name Table\n", Base + Delay->rvaINT);
	printf(" %08zX Bound Import Name Table\n",
	(Delay->rvaBoundIAT == 0) ? 0 : Base + Delay->rvaBoundIAT);
	printf(" %08zX Unload Import Name Table\n",
	(Delay->rvaUnloadIAT == 0) ? 0 : Base + Delay->rvaUnloadIAT);
	printf(" %8X time date stamp\n", Delay->dwTimeStamp);
	printf("\n");
	Addr = (PIMAGE_THUNK_DATA)(Base + Delay->rvaIAT);
	Name = (PIMAGE_THUNK_DATA)(Base + Delay->rvaINT);
	for ( ; Addr->u1.Function != 0; ++Addr, ++Name) {
	if (IMAGE_SNAP_BY_ORDINAL(Name->u1.Ordinal)) {
	printf(" %08zX Ordinal %zd\n", Addr->u1.Function, IMAGE_ORDINAL(Name->u1.Ordinal));
	} else {
	ImpName = (PIMAGE_IMPORT_BY_NAME)(Base + Name->u1.AddressOfData);
	printf(" %08zX %8X %s\n", Addr->u1.Function, ImpName->Hint, ImpName->Name);
	}
	}
	printf("\n");
	}
	printf("\n");
	}

	static void
	dump_exports(DWORD_PTR Base)
	{
	ULONG Size;
	PIMAGE_EXPORT_DIRECTORY Exp;
	WORD *Ordinal;
	DWORD *Addr;
	DWORD *Name;
	DWORD hint;
	char buf[32];

	Exp = MyImageDirectoryEntryToData(
	(LPVOID)Base,
	TRUE,
	IMAGE_DIRECTORY_ENTRY_EXPORT,
	&Size);
	if (Exp == NULL)
	return;

	printf(" Section contains the following exports for %s\n", (char *)Base + Exp->Name);
	printf("\n");
	printf(" %08X characteristics\n", Exp->Characteristics);
	printf(" %8X time date stamp %s", Exp->TimeDateStamp, ctime((time_t *)(&Exp->TimeDateStamp)));
	sprintf(buf, "%d.%02d", Exp->MajorVersion, Exp->MinorVersion);
	printf(" %8s version\n", buf);
	printf(" %8d ordinal base\n", Exp->Base);
	printf(" %8d number of functions\n", Exp->NumberOfFunctions);
	printf(" %8d number of names\n", Exp->NumberOfNames);
	printf("\n");
	printf(" ordinal hint RVA name\n");
	printf("\n");
	Ordinal = (WORD *)(Base + Exp->AddressOfNameOrdinals);
	Addr = (DWORD *)(Base + Exp->AddressOfFunctions);
	Name = (DWORD *)(Base + Exp->AddressOfNames);
	for (hint = 0; hint < Exp->NumberOfNames; ++hint) {
	printf(" %7d %4X %08X %s\n",
	Exp->Base + Ordinal[hint],
	hint,
	Addr[Ordinal[hint]],
	(char *)Base + Name[hint]);
	}
	}

	int
	main(int argc, char **argv)
	{
	DWORD_PTR Base;
	if (argc == 3 && _stricmp(argv[1] + 1, "DEPENDENTS") == 0) {
	Base = load_module(argv[2]);
	dump_dependents(Base);
	} else if (argc == 3 && _stricmp(argv[1] + 1, "EXPORTS") == 0) {
	Base = load_module(argv[2]);
	dump_exports(Base);
	} else if (argc == 3 && _stricmp(argv[1] + 1, "IMPORTS") == 0) {
	Base = load_module(argv[2]);
	dump_imports(Base);
	dump_bound_imports(Base);
	dump_delay_imports(Base);
	} else {
	printf("usage: %s [option] [file]\n", argv[0]);
	printf("\n");
	printf(" /DEPENDENTS\n");
	printf(" /EXPORTS\n");
	printf(" /IMPORTS\n");
	}
	return 0;
	}