Stack Overflow
Stack Overflow

Questions tagged [pe-exports]

6 questions
5
votes
1 answer

How is dumpbin able to read the export table when it appears at a file offset larger than the file itself?

I'm writing a little PE reader, so I run dumpbin alongside my test application to confirm that the values are being read correctly. Everything it working so far, except for the export table. The file I'm testing with is a DLL. My application reads…
David Brown
  • 35,411
  • 11
  • 83
  • 132
3
votes
2 answers

Entries that are not functions in PE exports table

I've looked at an export table of a specific DLL and Iv'e seen some strange entries in the table so I tried to find an answer to this issue in the pecoff specification and didn't find any and I hope that someone maybe have one. I ran a dumpbin on a…
sborpo
  • 928
  • 7
  • 15
3
votes
1 answer

EXE exports static lib exports as well

I've created both a static lib and an EXE file (which uses the static lib), but when I open up the EXE in IDA pro, the exports are listed in the EXE as well. I know they should be exported in the .lib itself, but why are they showing up as exports…
Qix - MONICA WAS MISTREATED
  • 14,451
  • 16
  • 82
  • 145
2
votes
1 answer

How do I read the names from a PE module's export table?

I've successfully read a PE header from an unmanaged module loaded into memory by another process. What I'd like to do now is read the names of this module's exports. Basically, this is what I have so far (I've left out a majority of the PE parsing…
David Brown
  • 35,411
  • 11
  • 83
  • 132
0
votes
2 answers

VS2010 thread data stack

I just found out how to break into the SetTimer function inside a windows dll (user32.dll). link text However i need to know what arguments its called with. I think that the arguments are pushed onto the data stack right before calling the function,…
ronag
  • 49,529
  • 25
  • 126
  • 221
0
votes
3 answers

'Exports' naming convention - how does it work?

What rules apply to the name that ends up in the exports section of an PE (Portable Executable)? Roughly, I see names starting with an '_' underscore, a '?' question mark or an '@' at-sign. What do those mean, and what about the rest of the…
PatrickvL
  • 4,104
  • 2
  • 29
  • 45