One of the fields of the PE export table is the image name, see screenshot below for an example.

This name is part of the file, even though I can rename it to any other name after it's compiled.

My questions:

  • Why is it needed?
  • When is this name used?
  • What are the implications of this name and the file name going out of sync? Does it matter?

example export table

  • 1
    "Why is it needed?" -- What alternative did you think of? – Biswapriyo Sep 21 '20 at 4:06
  • 1
    Alternatives for what? Just use the dll file name? – Paul Sep 21 '20 at 6:32
  • 1
    It does not matter if the value is not correct. You can rename a DLL on disk and it will still load regardless of this value. This is often seen in malware. As for the real use: I have not found one yet. – David Sep 22 '20 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.