Image Export Table

Introduction

The IMAGE_EXPORT_DIRECTORY is not officially documented by Microsoft. Here are some notes from unofficial documentation.

IMAGE_EXPORT_DIRECTORY Structure

The IMAGE_EXPORT_DIRECTORY structure is comprised of 3 arrays:

• AddressOfFunctions: array containing pointers to exported functions.

• AddressOfNames: array containing names of exported functions.

• AddressOfNameOrdinals: array containing integer ordinal numbers (numeric identifiers) of exported functions. The term "ordinal" is chosen because it implies a specific order or sequence in which functions are listed within the DLL.

The IMAGE_EXPORT_DIRECTORY structure also includes the size of the arrays:

• NumberOfFunctions: DWORD of number of exported functons.

• NumberOfNames: DWORD of number function names.

IMPORTANT: The ordinal table (AddressOfNameOrdinals) and the name table (AddressOfNames) work in conjunction with each other.

From the official PE-COFF documentation:

The export name pointer table and the export ordinal table form two parallel arrays that are separated to allow natural field alignment. These two tables, in effect, operate as one table, in which the Export Name Pointer column points to a public (exported) name and the Export Ordinal column gives the corresponding ordinal for that public name.

It is the responsibility of the PE loader to resolve and patch the addresses of the exported functions.

Reference

Name and Ordinal table pointers in export directory are NULL although DLL exports functionsReverse Engineering Stack Exchange

Everything You Never Wanted To Know About DLLs

PE Internals Part 1: A few words about Export Address Table (EAT)