2

I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along with their Ordinal number and virtual address (VA):

enter image description here

This is a pretty cool feature of ProcessHacker, which I was not able to find in ProcessExplorer. However, regarding the entries you can see in this screen-shot, I was not able to find what do the ? (question marks) and the number, which prefixes the names of the functions, mean. Also, I'm not sure what the single and double @ (at) symbols in the name, followed by a group of capital letters or number, mean.

Question 1: What do the symbols (?, @), number-prefix and capital letter suffixes represent? How can one interpret them?

Question 2: What does the "Ordinal" column mean?

Question 3: Does the "VA" column show the offset of the procedure entry point, with respect to the base address of the .text segment of the DLL? If not, what does it represent?

Question 4: How can one compute the absolute address of any function from the Exports tab?

Improve this question
4
  • 2
    Here is a quick comparison of the export of a DLL found by Process Hacker and the exports identified by IDA. Hopefully the below answers and the side by side will be helpful. i.stack.imgur.com/T7VYk.png
    – alexanderh
    Feb 17, 2014 at 23:02
  • @alexanderh thanks for the photo. It sheds some light on the matter.
    – Benny
    Feb 18, 2014 at 10:24
  • It's better to open new questions than add new ones.
    – 0xea
    Feb 18, 2014 at 10:45
  • @0xea I did want to do that, however, the title of the question and the intro + picture would have been the same for the new question.
    – Benny
    Feb 18, 2014 at 10:46

2 Answers 2

Reset to default
2

Those are C++ name decorations.

Name decoration usually refers to C++ naming conventions, but can apply to a number of C cases as well. By default, C++ uses the function name, parameters, and return type to create a linker name for the function.

See Name Decoration on MSDN for more info.

Question 2: Ordinals are just another way of making exports. You either export a function by name or by ordinal. It is unique in that binary only. You get functions by ordinals by using GetProcAddress() just the same as you would with a name.

I could recommend "Windows via C/C++" book for many more details about those mechanisms.

Improve this answer
1
  • That page doesn't really offer a good explanation. OTOH, the remark at the bottom "There is currently no standard for C++ naming between compiler vendors or even between different versions of a compiler" is crucial. You can only guess what version was used by trying to decode.
    – Jongware
    Feb 17, 2014 at 22:34
2

I'd recommend loading the dll file into PE Explorer (View->Export), which will undecorate the names for you and show you the corresponding parameters/return value/calling convention.

You may also want to check out this question.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.