Wednesday, March 16, 2011

'Exports' naming convention - how does it work?

What rules apply to the name that ends up in the exports section of an PE (Portable Executable)? Roughly, I see names starting with an '_' underscore, a '?' question mark or an '@' at-sign. What do those mean, and what about the rest of the name?

Also - How can I reverse the naming convention into something more usable?

From stackoverflow
  • I should have looked a little longer before asking this - as I just found an answer to this:

    It's called 'name mangling', and here's a link explaning a bit about it : http://en.wikipedia.org/wiki/Name_mangling

    My apologies for bothering you; Cheers!

  • I think you are refering to "dll name mangling"

    name mangling

    It's used to make sure exports names are unique

    You can specify a .def file which will make it easier to use afterwards

    Simply put, a .def file is just a text file containing the following structure

    LIBRARY "MyDll"
    
    EXPORTS
        exportFunction1
    
    Rob Kennedy : Note that Delphi does not use DEF files. Instead, a name can be specified in the "exports" clause within the code. An index can be specified there, too.
  • One other thing : Jcl contains yet another very usefull function to decode these symbols. You can find it in JclPeImage; It's called PeUnmangleName - which is an extension of the UndecorateSymbolNameA/W WinAPI.

0 comments:

Post a Comment