NO

Author Topic: Export table  (Read 2824 times)

CLR

  • Guest
Export table
« on: September 15, 2013, 08:37:00 am »
Hello. For some reason dumpbin /EXPORTS from MS shows different results. Test file is C:\Windows\System32\mfc42.dll

dumpin from MSSDK:
Code: [Select]
ordinal hint RVA      name

   1452    0 000EF5D8 ?AfxFreeLibrary@@YAHPEAUHINSTANCE__@@@Z
   1494    1 000EF5A4 ?AfxLoadLibrary@@YAPEAUHINSTANCE__@@PEBD@Z
   1497    2 000F8344 ?AfxLockGlobals@@YAXH@Z
   1587    3 000F83DC ?AfxUnlockGlobals@@YAXH@Z
  7    4 000FC83C DllCanUnloadNow
  8    5 000FC7E0 DllGetClassObject
  9    6 000FC870 DllRegisterServer
10    7 000FC87C DllUnregisterServer

pe from japheth.de:
Code: [Select]
  RVA     # RVA-target Name
-----------------------------
 3B40     5       ED7C ?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
 3B44     6       ED44 ?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
 3B48     7      DEEAC DllCanUnloadNow
 3B4C     8      DEE6C DllGetClassObject
 3B50     9      DED0A DllRegisterServer
 3B54     A      DEEDE DllUnregisterServer

dumpin from masm32
Code: [Select]
ordinal hint RVA      name

  5    0 0000ED7C ?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
  6    1 0000ED44 ?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
  7    2 000DEEAC DllCanUnloadNow
  8    3 000DEE6C DllGetClassObject
  9    4 000DED0A DllRegisterServer
10    5 000DEEDE DllUnregisterServer

podump
Code: [Select]
ordinal  hint  address   name
  5     0  7189ED7C  ?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
  6     1  7189ED44  ?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
  7     2  7196EEAC  DllCanUnloadNow
  8     3  7196EE6C  DllGetClassObject
  9     4  7196ED0A  DllRegisterServer
  A     5  7196EEDE  DllUnregisterServer

Offline TimoVJL

  • Global Moderator
  • Member
  • *****
  • Posts: 1866
Re: Export table
« Reply #1 on: September 15, 2013, 10:04:57 am »
Hello. For some reason dumpbin /EXPORTS from MS shows different results. Test file is C:\Windows\System32\mfc42.dll

dumpin from MSSDK:
Code: [Select]
ordinal hint RVA      name

   1452    0 000EF5D8 ?AfxFreeLibrary@@YAHPEAUHINSTANCE__@@@Z
   1494    1 000EF5A4 ?AfxLoadLibrary@@YAPEAUHINSTANCE__@@PEBD@Z
   1497    2 000F8344 ?AfxLockGlobals@@YAXH@Z
   1587    3 000F83DC ?AfxUnlockGlobals@@YAXH@Z
  7    4 000FC83C DllCanUnloadNow
  8    5 000FC7E0 DllGetClassObject
  9    6 000FC870 DllRegisterServer
10    7 000FC87C DllUnregisterServer
...
What version dumpbin/link it was?

You can use PEView too.
« Last Edit: September 15, 2013, 10:16:56 am by timovjl »
May the source be with you

CLR

  • Guest
Re: Export table
« Reply #2 on: September 15, 2013, 10:44:39 am »
Hello. For some reason dumpbin /EXPORTS from MS shows different results. Test file is C:\Windows\System32\mfc42.dll

dumpin from MSSDK:
Code: [Select]
ordinal hint RVA      name

   1452    0 000EF5D8 ?AfxFreeLibrary@@YAHPEAUHINSTANCE__@@@Z
   1494    1 000EF5A4 ?AfxLoadLibrary@@YAPEAUHINSTANCE__@@PEBD@Z
   1497    2 000F8344 ?AfxLockGlobals@@YAXH@Z
   1587    3 000F83DC ?AfxUnlockGlobals@@YAXH@Z
  7    4 000FC83C DllCanUnloadNow
  8    5 000FC7E0 DllGetClassObject
  9    6 000FC870 DllRegisterServer
10    7 000FC87C DllUnregisterServer
...
What version dumpbin/link it was?

You can use PEView too.

Hi timovjl. It is version 10.00.30319.01.
And yes, PEView also displays 6 functions names.

Offline TimoVJL

  • Global Moderator
  • Member
  • *****
  • Posts: 1866
Re: Export table
« Reply #3 on: September 17, 2013, 06:52:52 pm »
Maybe dumpbin shows EXPORTS / ordinals from 64-bit version of mfc42.dll if you have 64-bit windows ???
May the source be with you