What does 'exported symbols' mean in lm co

问题:

I am in debugger session with WinDbg. I type lm command and it shows loaded modules but I don't quite understand what does the (export symbols) mean below?

048c0000 0550c000   Db         (export symbols)       Db.dll
05520000 05535000   Graph      (export symbols)       Graph.dll

I was expecting it will either say symbols not loaded or loaded or deferred but it's none of that. What does the (export symbols) indicate in this case?

回答1:

Exported symbols means that no PDB file was loaded and the symbols have been read from the binary (EXE, DLL) instead. A binary file has an export table. This table is used for resolving the symbols.

The export table is a feature of the PE file format. If you want to see it, you can use CFF Explorer. If you want a sample binary, use ntdll.dll from %windir%\system32:

Regarding the amount of information, it increases in this order:

• no symbols
• export symbols
• public symbols
• private symbols

You may also see "deferred" symbols, which means that WinDbg doesn't know yet, because it has not tried loading them. Use ld*;.reload if you want to get rid of the deferred symbols.