English 
home 
products pe explorer feature tour
DLL EXPORT VIEWER
Discover All Exported Functions in DLL
If you are trying to work with external functions in DLL and want to make sure you have the name and case of the function name correct, PE Explorer is the best solution you can get your hands on for viewing all of the exports from an EXE, DLL, DLL.MUN, or OCX. The DLL Export Viewer provides you with the information on entry points, numbers, names, memory addresses and calling syntax of exported functions.
The Export Function List Viewer shows those functions that may be called upon by other applications. In other words, these functions are what the file is making available to other programs
to call upon. PE Explorer provides important information about entry points, numbers, names and calling syntax of exported functions.
How do I get parameters on function exports?
Import Viewer
Function Syntax Lookup
Unmangling Exported Symbols
Retrieve the List of Exported Functions
The PE file header stores the information about every library that will be loaded and every function that will be used by the program. DLLs and EXEs export functions to interact with other programs and code.
Each program contains an import list for each DLL it uses, and each DLL contains an export list that gives the address inside the DLL file of each of the functions which the DLL allows other programs to access.
When the loader runs a program, it loads the associated DLLs into the process address space. It then extracts information about the import functions from the main program. The place in the DLLs where the PE loader looks for the addresses of the functions is the export table.
If you discover exports in an executable, they often will provide useful information. In many cases, software authors name their exported functions in a meaningful way. If malware uses exports, it will often either omit names entirely or use unclear or misleading names.
EXPORT PROPERTIES
Time Date Stamp — gives the time the table was created (some linkers set it to 0).
Ver — Version info ('MajorVersion' and 'MinorVersion'), and these, too, are often enough set to 0.
DLL Name — The internal DLL name. The name is necessary in case the DLL file is renamed.
Exported Functions — The total number of exported functions.
Exported Names — The number of functions that are exported by name. This value can be 0. In that case, the module may export by ordinal only.
Pointers to Entry Point — points to the head of the array of entry points 'AddressOfFunctions' (given as 32-bit-RVAs).
Pointers to Name — An RVA that points to an array of RVAs of the names of functions in the module.
Pointers to Ordinal — An RVA that points to a 16-bit array that contains the ordinals associated with the function names in the 'AddressOfNames' array.
The actual name of a procedure "as it is to be called" is found in the export table of any executable, EXE or DLL. The name which the calling program is going to use is in that calling program's import table.
When a DLL/EXE exports a function to be used by other DLL/EXE, it can do so in two ways: it can export the function by name or by ordinal only. Say if there is a function named "MapDebug-Information" in a DLL, it can choose to tell the other DLLs/EXEs that if they want to call the function, they must specify it by its name, ie. MapDebugInformation.
The other way is to export by ordinal. An ordinal is a 16-bit number that uniquely identifies a function in a particular DLL. This number is unique only within the DLL it refers to. For example, in the above example, the DLL can choose to export the function by ordinal 31. Then the other DLLs/EXEs which want to call this function must specify this number in GetProcAddress. This is called export by ordinal only.
See Quick Function Syntax Lookup for calling syntax of exported functions.
Download a 30 day trial version of PE Explorer Buy the Full Version