type
TDWordArray = array [0..$FFFFF] of DWORD;
TWordArray = array [0..$FFFFF] of WORD;
var
dirsize: Cardinal;
imageinfo:LoadedImage;
ped:PImageExportDirectory;
pFunRVAs,pNameRVAs: ^TDWordArray;
i,kiss:Integer;
funName:string;
addre:DWORD;
begin
if MapAndLoad(PAnsiChar('ntdll.dll'),nil,@imageinfo,True,True) then begin
ped:=ImageDirectoryEntryToData(imageinfo.MappedAddress,False,IMAGE_DIRECTORY_ENTRY_EXPORT,dirsize);
pFunRVAs := ImageRvaToVa(imageinfo.FileHeader, imageinfo.MappedAddress,DWORD(ped^.AddressOfFunctions), nil);
pNameRVAs := ImageRvaToVa(imageinfo.FileHeader, imageinfo.MappedAddress,DWORD(ped^.AddressOfNames), nil);
for i := 0 to ped^.NumberOfFunctions -1 do
begin
try
funName:=PChar(ImageRvaToVa(imageinfo.FileHeader, imageinfo.MappedAddress,pNameRVAs^[i], nil));
if Copy(funName,1,2)='Nt' then begin
mmo1.Lines.Add(funName);
addre:=DWORD(ImageRvaToVa(imageinfo.FileHeader,imageinfo.MappedAddress,pFunRVAs^[i],nil));
addre:=addre+1;
mmo1.Lines.Add(IntToHex(PWORD(addre)^,2));
end;
except
end;
end;
UnMapAndLoad(@imageinfo);
end;
end;
