One of the fields of the PE export table is the image name, see screenshot below for an example.

This name is part of the file, even though I can rename it to any other name after it's compiled.

My questions:

  • Why is it needed?
  • When is this name used?
  • What are the implications of this name and the file name going out of sync? Does it matter?

example export table

  • 1
    "Why is it needed?" -- What alternative did you think of?
    – Biswapriyo
    Sep 21, 2020 at 4:06
  • 1
    Alternatives for what? Just use the dll file name?
    – Paul
    Sep 21, 2020 at 6:32
  • 1
    It does not matter if the value is not correct. You can rename a DLL on disk and it will still load regardless of this value. This is often seen in malware. As for the real use: I have not found one yet.
    – David
    Sep 22, 2020 at 21:52


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.