2

I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along with their Ordinal number and virtual address (VA):

enter image description here

This is a pretty cool feature of ProcessHacker, which I was not able to find in ProcessExplorer. However, regarding the entries you can see in this screen-shot, I was not able to find what do the ? (question marks) and the number, which prefixes the names of the functions, mean. Also, I'm not sure what the single and double @ (at) symbols in the name, followed by a group of capital letters or number, mean.

Question 1: What do the symbols (?, @), number-prefix and capital letter suffixes represent? How can one interpret them?

Question 2: What does the "Ordinal" column mean?

Question 3: Does the "VA" column show the offset of the procedure entry point, with respect to the base address of the .text segment of the DLL? If not, what does it represent?

Question 4: How can one compute the absolute address of any function from the Exports tab?

  • 2
    Here is a quick comparison of the export of a DLL found by Process Hacker and the exports identified by IDA. Hopefully the below answers and the side by side will be helpful. i.stack.imgur.com/T7VYk.png – alexanderh Feb 17 '14 at 23:02
  • @alexanderh thanks for the photo. It sheds some light on the matter. – Benny Feb 18 '14 at 10:24
  • It's better to open new questions than add new ones. – 0xea Feb 18 '14 at 10:45
  • @0xea I did want to do that, however, the title of the question and the intro + picture would have been the same for the new question. – Benny Feb 18 '14 at 10:46
2

Those are C++ name decorations.

Name decoration usually refers to C++ naming conventions, but can apply to a number of C cases as well. By default, C++ uses the function name, parameters, and return type to create a linker name for the function.

See Name Decoration on MSDN for more info.

Question 2: Ordinals are just another way of making exports. You either export a function by name or by ordinal. It is unique in that binary only. You get functions by ordinals by using GetProcAddress() just the same as you would with a name.

I could recommend "Windows via C/C++" book for many more details about those mechanisms.

  • That page doesn't really offer a good explanation. OTOH, the remark at the bottom "There is currently no standard for C++ naming between compiler vendors or even between different versions of a compiler" is crucial. You can only guess what version was used by trying to decode. – usr2564301 Feb 17 '14 at 22:34
2

I'd recommend loading the dll file into PE Explorer (View->Export), which will undecorate the names for you and show you the corresponding parameters/return value/calling convention.

You may also want to check out this question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.