GetProcAddress Alternative via PE Export Table

This code demonstrates an alternative approach to calling external functions without using the GetProcAddress WinAPI function, which is commonly used to retrieve the address of exported functions from DLL files.

Traditionally, when using an external function from a library, developers would need to use LoadLibrary to map the library into memory, and then call GetProcAddress on the returned handle to obtain the address of the desired exported function.

However, it is possible to achieve the same goal without relying on GetProcAddress by manually parsing the PE header of the target library. It should be noted that even with this approach, LoadLibrary is still required to map the target library into memory, unless the DLL is loaded using an alternative method such as with the reflected DLL technique.

GetProcAddress DLL Export Table PE PE+

Depends On

Enumerate DLL Exports

Code Section

                                // Jean-Pierre LESUEUR (@DarkCoderSc)
// ...
uses tlhelp32, Windows, SysUtils, uEnumDLLExport;
// ...

{
  Retrieve module full path from it handle (Returned by LoadLibrary()), we need
  that information to parse it PE Header and retrieve function address.
}
function GetModuleImagePath(hModule : HMODULE) : String;
var ASnap        : THandle;
    AModuleEntry : TModuleEntry32;

const TH32CS_SNAPMODULE32 = $00000010;

begin
  result := '';
  ///

  ASnap := CreateToolHelp32Snapshot(TH32CS_SNAPMODULE or TH32CS_SNAPMODULE32, GetCurrentProcessId());
  if ASnap = INVALID_HANDLE_VALUE then
    Exit();
  try
    ZeroMemory(@AModuleEntry, SizeOf(TModuleEntry32));

    AModuleEntry.dwSize := SizeOf(TModuleEntry32);
    ///

    if NOT Module32First(ASnap, AModuleEntry) then
      Exit();

    if (AModuleEntry.hModule = hModule) then begin
      result := AModuleEntry.szExePath;

      Exit();
    end;

    while True do begin
      ZeroMemory(@AModuleEntry, SizeOf(TModuleEntry32));

      AModuleEntry.dwSize := SizeOf(TModuleEntry32);
      ///

      if NOT Module32Next(ASnap, AModuleEntry) then
        Break;

      if (AModuleEntry.hModule = hModule) then begin
        result := AModuleEntry.szExePath;

        break;
      end;
    end;
  finally
    CloseHandle(ASnap);
  end;
end;

{
  Retrieve function address from DLL PE Header Export Function Table.
}
function GetProcAddress_ALT(hModule : HMODULE; lpProcName : LPCSTR) : Pointer;
var ADLLExport : TEnumDLLExport;
    I          : Integer;
begin
  result := nil;
  ///

  ADLLExport := TEnumDLLExport.Create(GetModuleImagePath(hModule));

  if (ADLLExport.Enum > 0) then begin
    for I := 0 to ADLLExport.Items.Count -1 do begin
      if (ADLLExport.Items[i].Name.ToLower = String(lpProcName).ToLower) then begin
        result := Pointer(hModule + ADLLExport.Items[i].RelativeAddr);

        break;
      end;
    end;
  end;
end;

// ...

// MessageBoxW Example

// ...

procedure LoadAndTriggerMessageBox();
var _MessageBoxW : function(hWnd: HWND; lpText, lpCaption: LPCWSTR; uType: UINT): Integer; stdcall;
    hModule      : HMODULE;
begin
  _MessageBoxW := nil;

  hModule := LoadLibrary('user32.dll');

  @_MessageBoxW := GetProcAddress_ALT(hModule, 'MessageBoxW');

  if Assigned(_MessageBoxW) then
    _MessageBoxW(0, 'Hello World', 'Hey', 0);
end;

begin
  LoadAndTriggerMessageBox();
end.

July 4, 2023, 9:53 a.m. | By Jean-Pierre LESUEUR