/peimports

based on golang's debug/pe this package gives quick access to the ordered imports of pe files with ordinal support

Primary LanguageGoBSD 3-Clause "New" or "Revised" LicenseBSD-3-Clause

This code is almost entirely derived from the Go standard library's debug/pe package. It didn't provide access to ordinal based entries in the IAT and for a particular use case it performed more work parsing a PE file that needed. This package is just reduced down heavily so that ordinals are provided and an object has a ImportedSymbols method only.

	peObj, err := peimports.NewFile(f)
	if err != nil {
		panic(err)
	}

	fmt.Println(peObj.ImportedSymbols())

Will print output such as:

[12:WS2_32.dll 115:WS2_32.dll 11:WS2_32.dll 9:WS2_32.dll 19:WS2_32.dll 21:WS2_32.dll 116:WS2_32.dll 16:WS2_32.dll 23:WS2_32.dll 3:WS2_32.dll 52:WS2_32.dll 4:WS2_32.dll CreateFileA:KERNEL32.dll GetFileSize:KERNEL32.dll SetPriorityClass:KERNEL32.dll SetFilePointer:KERNEL32.dll SetErrorMode:KERNEL32.dll FreeLibrary:KERNEL32.dll GetCurrentProcess:KERNEL32.dll WaitForSingleObject:KERNEL32.dll GetModuleHandleW:KERNEL32.dll GetTickCount:KERNEL32.dll VirtualFree:KERNEL32.dll GetWindowsDirectoryA:KERNEL32.dll WriteFile:KERNEL32.dll GetCommandLineA:KERNEL32.dll LoadLibraryW:KERNEL32.dll TerminateThread:KERNEL32.dll Sleep:KERNEL32.dll CreateSemaphoreA:KERNEL32.dll CreateProcessA:KERNEL32.dll TerminateProcess:KERNEL32.dll ReadFile:KERNEL32.dll ExitThread:KERNEL32.dll ReleaseSemaphore:KERNEL32.dll GetLastError:KERNEL32.dll GetProcAddress:KERNEL32.dll LoadLibraryA:KERNEL32.dll GetExitCodeThread:KERNEL32.dll GetModuleHandleA:KERNEL32.dll VirtualProtect:KERNEL32.dll CloseHandle:KERNEL32.dll DeleteFileW:KERNEL32.dll GetCurrentProcessId:KERNEL32.dll GetTempPathA:KERNEL32.dll CreateThread:KERNEL32.dll WideCharToMultiByte:KERNEL32.dll FormatMessageW:KERNEL32.dll ExitProcess:KERNEL32.dll LocalAlloc:KERNEL32.dll LocalSize:KERNEL32.dll GetPriorityClass:KERNEL32.dll OpenProcess:KERNEL32.dll Process32FirstW:KERNEL32.dll Process32NextW:KERNEL32.dll CreateToolhelp32Snapshot:KERNEL32.dll MultiByteToWideChar:KERNEL32.dll SetProcessPriorityBoost:KERNEL32.dll CopyFileW:KERNEL32.dll GetModuleFileNameW:KERNEL32.dll GetTempPathW:KERNEL32.dll QueueUserAPC:KERNEL32.dll CopyFileA:KERNEL32.dll VirtualAllocEx:KERNEL32.dll GetModuleFileNameA:KERNEL32.dll lstrcatW:KERNEL32.dll WriteProcessMemory:KERNEL32.dll ResumeThread:KERNEL32.dll GlobalLock:KERNEL32.dll GlobalAlloc:KERNEL32.dll GlobalUnlock:KERNEL32.dll GlobalFree:KERNEL32.dll DeleteFileA:KERNEL32.dll GetUserDefaultLCID:KERNEL32.dll GetStringTypeW:KERNEL32.dll QueryPerformanceCounter:KERNEL32.dll GetEnvironmentStringsW:KERNEL32.dll FreeEnvironmentStringsW:KERNEL32.dll GetLocaleInfoW:KERNEL32.dll InterlockedExchange:KERNEL32.dll SetConsoleCtrlHandler:KERNEL32.dll GetTimeZoneInformation:KERNEL32.dll RtlUnwind:KERNEL32.dll GetLocaleInfoA:KERNEL32.dll EnumSystemLocalesA:KERNEL32.dll IsValidLocale:KERNEL32.dll HeapReAlloc:KERNEL32.dll SetStdHandle:KERNEL32.dll WriteConsoleW:KERNEL32.dll InitializeCriticalSection:KERNEL32.dll CompareStringW:KERNEL32.dll SetEnvironmentVariableA:KERNEL32.dll CreateFileW:KERNEL32.dll SetEndOfFile:KERNEL32.dll GetProcessHeap:KERNEL32.dll InterlockedCompareExchange:KERNEL32.dll lstrlenW:KERNEL32.dll LCMapStringW:KERNEL32.dll FlushFileBuffers:KERNEL32.dll GetConsoleMode:KERNEL32.dll GetConsoleCP:KERNEL32.dll FatalAppExitA:KERNEL32.dll HeapDestroy:KERNEL32.dll HeapCreate:KERNEL32.dll DeleteCriticalSection:KERNEL32.dll GetFileType:KERNEL32.dll InitializeCriticalSectionAndSpinCount:KERNEL32.dll GetStdHandle:KERNEL32.dll SetHandleCount:KERNEL32.dll RaiseException:KERNEL32.dll HeapSize:KERNEL32.dll GetCurrentThread:KERNEL32.dll GetCurrentThreadId:KERNEL32.dll SetLastError:KERNEL32.dll TlsFree:KERNEL32.dll TlsSetValue:KERNEL32.dll TlsGetValue:KERNEL32.dll TlsAlloc:KERNEL32.dll IsValidCodePage:KERNEL32.dll EncodePointer:KERNEL32.dll DecodePointer:KERNEL32.dll HeapFree:KERNEL32.dll EnterCriticalSection:KERNEL32.dll LeaveCriticalSection:KERNEL32.dll GetSystemTimeAsFileTime:KERNEL32.dll HeapAlloc:KERNEL32.dll HeapSetInformation:KERNEL32.dll GetStartupInfoW:KERNEL32.dll UnhandledExceptionFilter:KERNEL32.dll SetUnhandledExceptionFilter:KERNEL32.dll IsDebuggerPresent:KERNEL32.dll IsProcessorFeaturePresent:KERNEL32.dll GetCPInfo:KERNEL32.dll InterlockedIncrement:KERNEL32.dll InterlockedDecrement:KERNEL32.dll GetACP:KERNEL32.dll GetOEMCP:KERNEL32.dll GetDC:USER32.dll ReleaseDC:USER32.dll CopyIcon:USER32.dll GetDesktopWindow:USER32.dll MessageBoxW:USER32.dll SetSystemCursor:USER32.dll GetClientRect:USER32.dll LoadCursorW:USER32.dll GetSystemMetrics:USER32.dll BitBlt:GDI32.dll StretchBlt:GDI32.dll DeleteObject:GDI32.dll SelectObject:GDI32.dll CreateCompatibleDC:GDI32.dll CreateCompatibleBitmap:GDI32.dll GetObjectW:GDI32.dll SetStretchBltMode:GDI32.dll GetDIBits:GDI32.dll AdjustTokenPrivileges:ADVAPI32.dll LookupPrivilegeValueW:ADVAPI32.dll OpenProcessToken:ADVAPI32.dll ShellExecuteA:SHELL32.dll SHGetSpecialFolderPathA:SHELL32.dll CoInitialize:ole32.dll CoUninitialize:ole32.dll CoCreateInstance:ole32.dll 4:OLEAUT32.dll 6:OLEAUT32.dll 8:OLEAUT32.dll GdipGetImageEncodersSize:gdiplus.dll GdiplusStartup:gdiplus.dll GdipCloneImage:gdiplus.dll GdipSaveImageToFile:gdiplus.dll GdiplusShutdown:gdiplus.dll GdipFree:gdiplus.dll GdipAlloc:gdiplus.dll GdipDisposeImage:gdiplus.dll GdipCreateBitmapFromHBITMAP:gdiplus.dll GdipGetImageEncoders:gdiplus.dll]

Notice that the WS2_32.dll imports are numeric which means they are imported using an ordinal number.