You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As per PE Format specification, symbols defined in the Export Data directory can be forwarders to exported symbols defined in other, external modules. In such a case, the exported reference (as exposed by the ExportedSymbol::Address property) points to a name within the export directory itself, as opposed to some code or data somewhere else in the PE.
Currently there is no way to easily distinguish between normal exports and forwarder exports, nor is there a way for the builder to define new forwarder exports.
Proposal
Add string? ForwardedSymbolName and bool IsForwarder properties to ExportedSymbol.
Alternatives
Users could implement a read-only version of the IsForwarder property themselves by testing whether Address falls within the VA and Size of the export data directory exposed by the optional header. This, however, assumes that this information is available, which is not necessarily the case for PEs that are constructed from scratch.
Besides, the current PE builder does not support creating forwarder exports, so saving them is impossible right now without some heavy customization of the existing PE builders themselves.
Additional Context
Exports are often forwarded in many Windows DLLs. For example, kernel32.dll defines many exports that are forwarded to ntdll.dll or kernelbase.dll.
The text was updated successfully, but these errors were encountered:
Problem Description
As per PE Format specification, symbols defined in the Export Data directory can be forwarders to exported symbols defined in other, external modules. In such a case, the exported reference (as exposed by the
ExportedSymbol::Address
property) points to a name within the export directory itself, as opposed to some code or data somewhere else in the PE.Currently there is no way to easily distinguish between normal exports and forwarder exports, nor is there a way for the builder to define new forwarder exports.
Proposal
Add
string? ForwardedSymbolName
andbool IsForwarder
properties toExportedSymbol
.Alternatives
Users could implement a read-only version of the
IsForwarder
property themselves by testing whetherAddress
falls within the VA and Size of the export data directory exposed by the optional header. This, however, assumes that this information is available, which is not necessarily the case for PEs that are constructed from scratch.Besides, the current PE builder does not support creating forwarder exports, so saving them is impossible right now without some heavy customization of the existing PE builders themselves.
Additional Context
Exports are often forwarded in many Windows DLLs. For example, kernel32.dll defines many exports that are forwarded to ntdll.dll or kernelbase.dll.
The text was updated successfully, but these errors were encountered: