How to export the address of an entry in the export table?

[japheth]

Hi,

is it possible to export the address of another export in the export table?

The addresses of the exported functions are in a table and I want to export the address of one of those exports ( similiar to the export "pfnRealizePalette" in GDI32, which exports the address of the "RealizePalette" entry).

I tried (let's assume as example the GDI32 function mentioned above):

EXPORTS
  RealizePalette
  pfnRealizePalette=RealizePalette

but this gives me just a clone of RealizePalette.

Japheth

[Liquid]

EXPORTS
  RealizePalette
  pfnRealizePalette=RealizePalette

but this gives me just a clone of RealizePalette.

Because that's the export definition file syntax for declaring an alias.
Basically it just renames the export.

Anyway, is export forwarding what you're after by any chance?

[japheth]

> Anyway, is export forwarding what you're after by any chance?

No. Exporting an address of an entry in the export's "table of functions" seems not possible. At last I constructed a workaround:

Code Select Expand


   .data
    public pfnRealizePalette
pfnRealizePalette dd _RealizePalette

    .code
    public RealizePalette@4
RealizePalette@4:
    jmp [pfnRealizePalette]
_RealizePalette proc
   ...


This works ok, but adds a level of indirection and looks ugly.

Regards

Japheth

[sinsi]

Surely exporting in the first place gives an address? I am confused as to what you are trying to do.  :(

PS what is this GDI32 function pfnRealizePalette?

[MichaelW]

For the GDI32.DLL on my Windows 2000 system, pfnRealizePalette is not among the exports, and the name is not in any DLL in system32. In searching I found many instances of this. GDI32.DLL does import UserRealizePalette (which apparently calls NtGdiRealizePalette).

[japheth]

> PS what is this GDI32 function pfnRealizePalette?
> For the GDI32.DLL on my Windows 2000 system, pfnRealizePalette is not among the exports

It is exported in Win9x. Somehow USER32 and GDI32 must communicate when an application changes the system palette, because USER32 then needs to send the WM_PALETTECHANGED message. Obviously this communication  is implemented differently in win9x and win2k. But this is getting off-topic, I mentioned the RealizePalette hooking  just as an example.