Question

Is there any way to postprocess a DLL and its .lib file to remove symbols that I do not want within them?

Background:

The DLL’s code uses boost::serialization, which dllexports (many many) symbols. Apparently this is so as to cause the linker not to omit static objects that are unreferenced but have important side effects when initialized.

However, I’d very much prefer that there be no hint of boost within the DLL’s exported symbols.

I reason that since the link step has completed that it would be safe to remove the mess in the symbol table caused by the library.

Hence, I am wondering if there exists some tool to accomplish this.

Answer 1

I don’t know a tool that does this, but here is a piece of C++ code you can build that can change a DLL exported names. In this case, you can set the names you don’t want to an empty string (the 0 character):

void RemoveUnwantedExports(PSTR ImageName)
{
    LOADED_IMAGE image;
    // load dll in memory for r/w access
    // you'll need Imagehlp.h and Imagehlp.lib to compile successfully
    if (MapAndLoad(ImageName, NULL, &image, TRUE, FALSE))
    {
        // get the export table
        ULONG size;
        PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY)ImageDirectoryEntryToData(image.MappedAddress, FALSE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size);

        PIMAGE_SECTION_HEADER *pHeader = new PIMAGE_SECTION_HEADER();

        // get the names address
        PULONG names = (PULONG)ImageRvaToVa(image.FileHeader, image.MappedAddress, exports->AddressOfNames, pHeader);

        for (ULONG i = 0; i < exports->NumberOfNames; i++)
        {
            // get a given name
            PSTR name = (PSTR)ImageRvaToVa(image.FileHeader, image.MappedAddress, names[i] , pHeader);

            // printf("%s\n", name); // debug info

            if (IsUnwanted(name))
            {
                name[0] = 0; // set it to an empty string
            }
        }

        UnMapAndLoad(&image); // commit & write
    }
}

BOOL IsUnwanted(PSTR name)
{
  // implement this
}

It’s more some kind of obfuscation but removing names completely is more complex since it requires a full consistent rewrite of the exports section.