cplib

README

Copy Library

What is this?

This tool will generate Go source for you. It will read the exports of a shared library (DLL or so) or it will read the imports of an executable. The imports can be filtered down by the library they are expected to be found in.

How to install

Open a terminal and run the following:

$ go install github.com/mjwhitta/cplib/cmd/cplib@latest

Or compile from source:

$ git clone https://github.com/mjwhitta/cplib.git
$ cd cplib
$ git submodule update --init
$ make

How to use

NOTE: The generated source is meant to be used with something like goDLL so you may need to adjust the build tags.

List exports from a DLL:

$ cplib -e "c:/program files/windows defender/mpclient.dll"

Generate source for all exports from a DLL:

$ cplib -e -g "c:/program files/windows defender/mpclient.dll"

List exports from a shared-object:

$ cplib -e /usr/lib/x86_64-linux-gnu/libyaml.so

Generate source for all exports from a DLL:

$ cplib -e -g /usr/lib/x86_64-linux-gnu/libyaml.so

List specific imports of an executable:

$ cplib -f mpclient.dll -i "c:/program files/windows defender/mpcmdrun.exe"

Generate source for specific imports of an executable:

$ cplib -f mpclient.dll -g -i "c:/program files/windows defender/mpcmdrun.exe"

Links

• Source

TODO

• Add support for macOS

Documentation

Index

• Constants
• func ELFExports(fn string) ([]string, error)
• func GenerateGo(bin string, fn string, tags string, exports []string, imports []Import, ...) (e error)
• func PEExports(fn string) ([]string, error)
• type ExportTable
  • func GetExportTable(pf *pe.File) (*ExportTable, error)
  • func (et *ExportTable) Names() []string
• type FileType
  • func NaiveFileType(bin string) FileType
• type Import
  • func ELFImports(fn string) ([]Import, error)
  • func PEImports(fn string) ([]Import, error)

Constants

const (
	TypeUnknown = iota
	TypeELF
	TypePE
)

FiltType consts

const Version = "1.2.7"

Version is the package version.

Functions

func ELFExports

func ELFExports(fn string) ([]string, error)

ELFExports will read the provided filename and, if it's an ELF, it will return a list of functions that are exported.

func GenerateGo

func GenerateGo(
	bin string,
	fn string,
	tags string,
	exports []string,
	imports []Import,
	appendToFile bool,
) (e error)

GenerateGo will generate Go source for all of the exports and imports provided and write to the provided filename.

func PEExports

func PEExports(fn string) ([]string, error)

PEExports will read the provided filename and, if it's a PE, it will return a list of functions that are exported.

Types

type ExportTable

type ExportTable struct {
	AddressOfFuncs        uint32
	AddressOfNameOrdinals uint32
	AddressOfNames        uint32
	Base                  uint32
	Characteristics       uint32
	Checksum              uint32
	MajorVersion          uint16
	MinorVersion          uint16
	Name                  uint32
	NumberOfFuncs         uint32
	NumberOfNames         uint32
	// contains filtered or unexported fields
}

ExportTable is a struct containing relevant export data for a PE file.

func GetExportTable

func GetExportTable(pf *pe.File) (*ExportTable, error)

GetExportTable will return the export table for the provided PE file.

func (*ExportTable) Names

func (et *ExportTable) Names() []string

Names will return a list of exported function names.

type FileType

type FileType uint32

FileType is an enum

func NaiveFileType

func NaiveFileType(bin string) FileType

NaiveFileType does some very naive checks to determine file type.

type Import

type Import struct {
	Library string
	Name    string
}

Import is a generic struct that contains the imported function name and the library that is expected to contain it.

func ELFImports

func ELFImports(fn string) ([]Import, error)

ELFImports will read the provided filename and, if it's an ELF, it will return a list of functions that are imported.

func PEImports

func PEImports(fn string) ([]Import, error)

PEImports will read the provided filename and, if it's a PE, it will return a list of functions that are imported.