- Forum
- General C++ Programming
- How do Windows (or any other OS) get its
How do Windows (or any other OS) get its label names back?
With the LoadLibrary function (followed by GetProcAddress) you can get a function or any other thing that is on DLL export. AFAIK, when you assemble one program, it loses all user-reading data (names in general). How do the OS's get them?
Last edited on
When a program uses functions from a dlls, compiler adds into exe file special "import" tables for every used dll. So every table has caption, i.e. dll file name (ex "user32.dll").
There are two columns in every table. First column contains used function names. Second column contains functions' addresses. In exe file second column filled with zeroes.
When program loaded for execution, loader reads "import" section in exe file.
Then loader reads names of every table in this section and loads dlls with these names.
After it, for every table, for every row in table loader reads function name from first column and writes actual function address into second column.
Program reads these addresses and can calls functions.
When you call such function, compiler really writes something like
(*ShowWindow)(hWnd, hCmd);
or more really
(*user32[17][1])(hWnd, hCmd);
//17 - a sample. Actually may be other.
For more info you can try "PE Explorer" and "Dependency Walker".
There you can find that every dll has "export" table with two columns too.
First column contains function name. Second column contains relative address of this function.
There are two columns in every table. First column contains used function names. Second column contains functions' addresses. In exe file second column filled with zeroes.
When program loaded for execution, loader reads "import" section in exe file.
Then loader reads names of every table in this section and loads dlls with these names.
After it, for every table, for every row in table loader reads function name from first column and writes actual function address into second column.
Program reads these addresses and can calls functions.
When you call such function, compiler really writes something like
(*ShowWindow)(hWnd, hCmd);
or more really
(*user32[17][1])(hWnd, hCmd);
//17 - a sample. Actually may be other.
For more info you can try "PE Explorer" and "Dependency Walker".
There you can find that every dll has "export" table with two columns too.
First column contains function name. Second column contains relative address of this function.
Last edited on
@Konstantin2 thank you for your reply. That means that my thought wasn't correct?
That works only for exported functions or "inline" (eg.: not exported) function will still have their names?
That works only for exported functions or "inline" (eg.: not exported) function will still have their names?
Topic archived. No new replies allowed.