# Import Export Resolver

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-marcosd4h-deepextractruntime-import-export-resolver`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [marcosd4h](https://agentstack.voostack.com/s/marcosd4h)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [marcosd4h](https://github.com/marcosd4h)
- **Source:** https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/import-export-resolver

## Install

```sh
agentstack add skill-marcosd4h-deepextractruntime-import-export-resolver
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Import/Export Resolution

## Purpose

Resolve PE-level import and export relationships across all analyzed
modules. This skill works from the PE import/export tables stored in
`file_info.imports` and `file_info.exports` -- the authoritative record
of what the Windows loader resolves at load time.

This is distinct from code-level xrefs (`simple_outbound_xrefs`) that
`callgraph-tracer` uses. PE tables are ground truth for loader-level
dependencies; xrefs capture what IDA found in the disassembly. Use this
skill for loader-level questions, `callgraph-tracer` for code-level
call chains.

## When NOT to Use

- Tracing code-level call chains or cross-module execution paths -- use **callgraph-tracer**
- Categorizing imports by API type (file I/O, crypto, network, etc.) -- use **generate-re-report** (`analyze_imports.py`)
- Mapping attack surface or ranking entry points by risk -- use **map-attack-surface**
- General function explanation or decompiled code analysis -- use **re-analyst** or `/explain`
- Understanding cross-module data flow (taint propagation, parameter tracing) -- use **taint-analysis** or **data-flow-tracer**

## Data Sources

### SQLite Databases (primary)

- `file_info.imports` -- PE import table (JSON). Each entry has
  `module_name`, `functions[]` with `function_name`, `is_delay_loaded`,
  `ordinal`. API-set names are resolved to real DLLs.
- `file_info.exports` -- PE export table (JSON). Each entry has
  `function_name`, `ordinal`, `is_forwarded`, `forwarded_to`.
- `analyzed_files.db` -- tracking DB for module discovery.

See [data_format_reference.md](../docs/data_format_reference.md) and
[file_info_format_reference.md](../docs/file_info_format_reference.md)
for full JSON schemas.

### Finding a Module DB

```bash
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
```

## Utility Scripts

### query_function.py -- Resolve Function Importers/Exporters (Start Here)

Find which modules export a function and which modules import it.

```bash
python .claude/skills/import-export-resolver/scripts/query_function.py --function CreateProcessW

python .claude/skills/import-export-resolver/scripts/query_function.py --function CreateProcessW --direction export --json

python .claude/skills/import-export-resolver/scripts/query_function.py --function HeapAlloc --direction both --json
```

Output includes: list of exporting modules (with ordinal and forwarder
info) and list of importing modules (with source DLL and delay-load
status).

### build_index.py -- Build Cross-Module Import/Export Index

Build and cache the cross-module PE import/export index. Other scripts
invoke this automatically; run it directly to see index statistics.

```bash
python .claude/skills/import-export-resolver/scripts/build_index.py

python .claude/skills/import-export-resolver/scripts/build_index.py --json

python .claude/skills/import-export-resolver/scripts/build_index.py --no-cache
```

Output includes: module count, total exports, total imports, forwarded
export count, unique name counts.

### module_deps.py -- PE-Level Module Dependency Graph

Build a module dependency graph from PE import tables. Optionally focus
on a single module or show reverse dependencies (consumers).

```bash
python .claude/skills/import-export-resolver/scripts/module_deps.py

python .claude/skills/import-export-resolver/scripts/module_deps.py --module ntdll.dll --consumers --json

python .claude/skills/import-export-resolver/scripts/module_deps.py --module appinfo.dll --json

python .claude/skills/import-export-resolver/scripts/module_deps.py --diagram
```

### resolve_forwarders.py -- Follow Forwarded Export Chains

Follow forwarded export chains across DLLs (e.g.
`kernel32!HeapAlloc` -> `ntdll!RtlAllocateHeap`).

```bash
python .claude/skills/import-export-resolver/scripts/resolve_forwarders.py --module kernel32.dll --function HeapAlloc

python .claude/skills/import-export-resolver/scripts/resolve_forwarders.py --module kernel32.dll --all --json
```

## Workflows

### Workflow 1: "Which module exports CreateProcessW?"

Import/Export Resolution Progress:
- [ ] Step 1: Build or load the import/export index
- [ ] Step 2: Query for exporters

**Step 1**: Build the index (auto-cached).

```bash
python .claude/skills/import-export-resolver/scripts/build_index.py
```

**Step 2**: Query for the function.

```bash
python .claude/skills/import-export-resolver/scripts/query_function.py --function CreateProcessW --direction export --json
```

### Workflow 2: "What does appinfo.dll import and from where?"

Import/Export Resolution Progress:
- [ ] Step 1: Build the index
- [ ] Step 2: Query module suppliers

**Step 1**: Build the index.

```bash
python .claude/skills/import-export-resolver/scripts/build_index.py
```

**Step 2**: Get the module's import dependencies.

```bash
python .claude/skills/import-export-resolver/scripts/module_deps.py --module appinfo.dll --json
```

### Workflow 3: "Show all modules that depend on ntdll.dll"

Import/Export Resolution Progress:
- [ ] Step 1: Build the index
- [ ] Step 2: Query consumers

**Step 1**: Build the index.

```bash
python .claude/skills/import-export-resolver/scripts/build_index.py
```

**Step 2**: Find consumers of ntdll.dll.

```bash
python .claude/skills/import-export-resolver/scripts/module_deps.py --module ntdll.dll --consumers --json
```

## Step Dependencies

- `build_index.py` is a prerequisite for all other scripts (auto-invoked
  by the `ImportExportIndex` helper when needed).
- `query_function.py`, `module_deps.py`, and `resolve_forwarders.py`
  are independent of each other.

## Prompt Patterns

### Pattern A: Function resolution

> "which DLL exports CreateProcessW?"

- Run: `query_function.py --function CreateProcessW --direction export --json`

### Pattern B: Module dependency

> "what does appinfo.dll depend on?"

- Run: `module_deps.py --module appinfo.dll --json`

### Pattern C: Reverse dependency

> "who imports from ntdll.dll?"

- Run: `module_deps.py --module ntdll.dll --consumers --json`

## Exclusions

- Does NOT trace code-level xrefs or call chains. Use
  `callgraph-tracer` for that.
- Does NOT classify imports by API category (file I/O, crypto, etc.).
  Use `generate-re-report` (`analyze_imports.py`) for that.
- Does NOT analyze individual function behavior. Use
  `decompiled-code-extractor` or `security-dossier`.

## Degradation Paths

1. **Tracking DB missing** -- Report error with `NOT_FOUND`. Suggest
   `find_module_db.py --list` to verify available modules.
2. **Module has no imports/exports JSON** -- Skip module, log warning,
   continue indexing remaining modules.
3. **Forwarded export target not in analyzed set** -- Report chain
   endpoint and note the target module is not analyzed.
4. **Malformed JSON in file_info** -- `parse_json_safe` returns None;
   module is skipped with a warning. No crash.

## Integration with Other Skills

| Task | Recommended Skill |
|------|-------------------|
| Code-level call chain tracing | callgraph-tracer |
| Import categorization by API type | generate-re-report |
| Exports as attack entry points | map-attack-surface |
| Cross-module taint propagation | taint-analysis |

## Direct Helper Module Access

For programmatic use without the script wrappers:

- `helpers.ImportExportIndex(tracking_db)` -- build cross-module index
- `index.who_exports(name)` -- find all exporters
- `index.who_imports(name, from_module=...)` -- find all importers
- `index.module_consumers(name)` -- reverse dependency lookup
- `index.module_suppliers(name)` -- forward dependency lookup
- `index.resolve_forwarder_chain(module, function)` -- follow forwarders
- `index.dependency_graph()` -- full module dependency graph

## Performance

| Operation | Typical Time | Notes |
|---|---|---|
| Build full index (50 modules) | ~2-5s | Scales with total import/export count |
| Single function query | <0.1s | Index lookup after build |
| Module dependency graph | ~1s | Reuses cached index |
| Forwarder chain resolution | <0.5s | Bounded by max_depth=5 |

## Additional Resources

- [README.md](README.md) -- CLI usage examples and output format
- [data_format_reference.md](../docs/data_format_reference.md) -- DB schema
- [file_info_format_reference.md](../docs/file_info_format_reference.md) -- PE imports/exports JSON schema
- Related: [callgraph-tracer](../callgraph-tracer/SKILL.md) (code xrefs),
  [generate-re-report](../generate-re-report/SKILL.md) (import categorization),
  [map-attack-surface](../map-attack-surface/SKILL.md) (exports as entry points)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [marcosd4h](https://github.com/marcosd4h)
- **Source:** [marcosd4h/DeepExtractRuntime](https://github.com/marcosd4h/DeepExtractRuntime)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-marcosd4h-deepextractruntime-import-export-resolver
- Seller: https://agentstack.voostack.com/s/marcosd4h
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.