What rules apply to the name that ends up in the exports section of an PE (Portable Executable)? Roughly, I see names starting with an '_' underscore, a '?' question mark or an '@' at-sign. What do those mean, and what about the rest of the name?
Also - How can I reverse the naming convention into something more usable?
-
I should have looked a little longer before asking this - as I just found an answer to this:
It's called 'name mangling', and here's a link explaning a bit about it : http://en.wikipedia.org/wiki/Name_mangling
My apologies for bothering you; Cheers!
-
I think you are refering to "dll name mangling"
It's used to make sure exports names are unique
You can specify a .def file which will make it easier to use afterwards
Simply put, a .def file is just a text file containing the following structure
LIBRARY "MyDll" EXPORTS exportFunction1
Rob Kennedy : Note that Delphi does not use DEF files. Instead, a name can be specified in the "exports" clause within the code. An index can be specified there, too. -
One other thing : Jcl contains yet another very usefull function to decode these symbols. You can find it in JclPeImage; It's called PeUnmangleName - which is an extension of the UndecorateSymbolNameA/W WinAPI.
0 comments:
Post a Comment