I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along with their Ordinal number and virtual address (VA):
This is a pretty cool feature of ProcessHacker, which I was not able to find in ProcessExplorer. However, regarding the entries you can see in this screen-shot, I was not able to find what do the ?
(question marks) and the number, which prefixes the names of the functions, mean. Also, I'm not sure what the single and double @
(at) symbols in the name, followed by a group of capital letters or number, mean.
Question 1: What do the symbols (?, @
), number-prefix and capital letter suffixes represent? How can one interpret them?
Question 2: What does the "Ordinal" column mean?
Question 3: Does the "VA" column show the offset of the procedure entry point, with respect to the base address of the .text
segment of the DLL? If not, what does it represent?
Question 4: How can one compute the absolute address of any function from the Exports tab?