I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along with their Ordinal number and virtual address (VA):This is a pretty cool feature of ProcessHacker, which I was not able to find in ProcessExplorer. However, regarding the entries you can see in this screen-shot, I was not able to find what do the ? (question marks) and the number, which prefixes the names of the functions, mean. Also, I'm not sure what the single and double @ (at) symbols in the name, followed by a group of capital letters or number, mean.Question 1: What do the symbols (?, @), number-prefix and capital letter suffixes represent? How can one interpret them?Question 2: What does the Ordinal column mean?Question 3: Does the VA column show the offset of the procedure entry point, with respect to the base address of the .text segment of the DLL? If not, what does it represent?Question 4: How can one compute the absolute address of any function from the Exports tab?
How to interpret entries from Exports tab in ProcessHacker
dll;libraries;processhacker
Those are C++ name decorations. Name decoration usually refers to C++ naming conventions, but can apply to a number of C cases as well. By default, C++ uses the function name, parameters, and return type to create a linker name for the function. See Name Decoration on MSDN for more info.Question 2: Ordinals are just another way of making exports. You either export a function by name or by ordinal. It is unique in that binary only. You get functions by ordinals by using GetProcAddress() just the same as you would with a name. I could recommend Windows via C/C++ book for many more details about those mechanisms. 