0

One of the field of the IMAGE_EXPORT_DIRECTORY structure is 'Name'. According to the COFF spec, this field contains the name of the PE file which exports the symbols. I can programmatically read this field. It does really reference the name of the file which exports the symbols. But, can someone explains the meaning of this field? Why does it actually exist? It looks like it could be used as double-check..

Improve this question

1 Answer 1

Reset to default
2

The Name field in IMAGE_EXPORT_DIRECTORY contains the internal name of the module (i.e. original name that was used while building the module). This is useful in the cases where the actual file itself is renamed. For example, NT kernel that supports PAE is named as ntkrnlpa.exe. But, the Name field in its IMAGE_EXPORT_DIRECTORY struct still contains ntoskrnl.exe.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

You can also use Dependency Walker to traverse through PE file structs and tables: dependencywalker.com
Having this information field. I don't yet see the real reason for having such a field. Any idea WHY this field exists and where it is used for?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.