Have Geek Brain

How to hide export functions in DLL

I don't want the user to see all the Dependency export functionality in my DLL, is there a way to do this? I have combined my DLL with C ++ and MS Visual Studio.

+1


a source to share


7 replies


Use a * .def file and use the NONAME attribute to prevent the exported name: see Exporting functions from a DLL by original, not by name ... there's an example here .



+4


a source


It's really awkward, but if you don't want others to even see ordinals, you can combine your functions using COM. The COM DLL only provides common COM functions, so yours will be hidden. Then there are ways to use the DLL without registering it in the first place, so no information about the COM class you will be using is found on the system. This is definitely a strange reason for using COM, but the request is also quite unusual ...



+3


a source


Another option would be to create an exported function that will return an array of the addresses of the functions you would like to hide - after you have obtained those addresses, you can call them directly.

static void** Funcs = {&foo, &foo1, &foo2, 0};

__declspec (dllexport) void* GetFuncs (void)
{
   return &Funcs;
}

in your executable you can do the following

void** Funcs = GetFuncs();

(*Funcs[0]) (1, 2, 3);
+3


a source


IMO using NONAME is useless for this purpose - it doesn't hide dependencies. The dependencies will still be displayed (using ordinals). And your primary users will still be able to reach them via GetProcAddress.

I think you will have to use a more complex approach - for example the solutions suggested by eran.

+2


a source


A very simple way is to wrap it in a packer like UPX .
What you see exported is just what UPX uses to decompress the file into memory.

0


a source


No, it's all about the export so that they are VISIBLE.

This is the short answer. The long answer includes .def files. You can tell the linker to turn your C functions into indexes using the [definition file] ( http://msdn.microsoft.com/en-us/library/d91k01sh(VS.80).aspx) .

0


a source


Please do not try to hide your access inside the COM object, thinking that it will be hidden. See this article List COM Object Methods (IDispatch) Using ATL? to see how someone can examine a COM DLL for function names.

It is also desirable to hide the names of the exported functions. This is desirable when your DLL is for your own use, through other code modules, and does what only you want your calling code to access. This category could include algorithmic trade secrets.

Another trick is to export decoy functions that break or set internal state so that the code knows it has been compromised. In a compromised state, code can purposefully generate incorrect results or random failures. It can also send mail back to an account with snooper information.

0


a source






More articles:


All Articles