PE出口表设计
我刚刚浏览[1]，注意到以下摘录：
“导出函数的要求是名称、地址和 出口序号。你可能会认为 PE 格式的设计者 会将所有这三个项目放入一个结构中，然后 有一个由这些结构组成的数组。” “相反，一个 导出的条目是数组中的一个元素。有这三个 数组（AddressOfFunctions、AddressOfNames、AddressOfNameOrdinals）、 并且它们都是彼此平行的。”
我很好奇为什么它被实现为三个不同的数组而不是三个指针的结构。
谢谢！
[1] [http://msdn.microsoft.com/en-us/库/ms809762.aspx][1]
I was just going through [1] and I noticed the following excerpt:
"the requirements for exporting a function are a name, an address, and
an export ordinal. You'd think that the designers of the PE format
would have put all three of these items into a structure, and then
have an array of these structures." "Instead, each component of an
exported entry is an element in an array. There are three of these
arrays (AddressOfFunctions, AddressOfNames, AddressOfNameOrdinals),
and they are all parallel to one another."
I'm curious about why its implemented as three different arrays rather than a structure of three pointers.
Thanks!
[1] [http://msdn.microsoft.com/en-us/library/ms809762.aspx][1]
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，这个结构有点复杂。除了历史原因之外，它可能还针对通过序号（而不是名称）访问导入的符号进行了优化。
如果我没记错的话，
AddressOfFunctions是一个 RVA（相对于图像库的指针），指向包含导出符号的 RVA 的数组。序数是该数组中的索引。这样，如果您有它，您就可以快速识别该符号。OTOH，如果您只有符号名称，则
AddressOfNames是指向包含指向 ascii 字符串符号名称的指针的数组的 RVA。您必须找到该符号，然后使用在AddressOfNameOrdinals指向的数组中找到的索引，这将为您提供符号序数。Yes, this structure is somewhat complicated. Apart from historical reasons, it was probably optimized for accessing the imported symbols by ordinals (rather than names).
If I remember correctly, the
AddressOfFunctionsis an RVA (pointer relative to the image base) to an array containing RVAs of exported symbols. The ordinal is an index within this array. So that if you have it you can quickly identify the symbol.OTOH if you have the symbol name only, the
AddressOfNamesis an RVA to an array containing pointers to ascii string symbol names. You have to find the symbol, then use the found index in the array pointed byAddressOfNameOrdinals, this gives you the symbol ordinal.