'Exports' naming convention - how does it work?

Question

What rules apply to the name that ends up in the exports section of an PE (Portable Executable)? Roughly, I see names starting with an '_' underscore, a '?' question mark or an '@' at-sign. What do those mean, and what about the rest of the name?

Also - How can I reverse the naming convention into something more usable?

Answer 1

I think you are refering to "dll name mangling"

name mangling

It's used to make sure exports names are unique

You can specify a .def file which will make it easier to use afterwards

Simply put, a .def file is just a text file containing the following structure

LIBRARY "MyDll"

EXPORTS
    exportFunction1

Answer 2

One other thing : Jcl contains yet another very usefull function to decode these symbols. You can find it in JclPeImage; It's called PeUnmangleName - which is an extension of the UndecorateSymbolNameA/W WinAPI.

Answer 3

I should have looked a little longer before asking this - as I just found an answer to this:

It's called 'name mangling', and here's a link explaning a bit about it : http://en.wikipedia.org/wiki/Name_mangling

My apologies for bothering you; Cheers!