0

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are specific to the application, others are from the boost and QT libraries. Any idea why this would be? Is it a side effect of Themida, or a mistake by the app developers?

1

Most of the time it is just a benign side effect of linking in code that exposes their APIs as DLL exports. It is fairly common for 3rd party middleware/libraries to do this so that their code will work in both DLLs and EXEs without modification.

For boost, any of their methods that are marked with BOOST_SYMBOL_EXPORT will get tagged for DLL export:

Defines the syntax of a C++ language extension that indicates a symbol is to be exported from a shared library. If the compiler has no such extension, the macro is defined with no replacement text.


I have seen some EXE binaries explicitly export function entry points for easier communication back and forth between DLL plugins, but this is a lot more rare the the above case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.