.EXE File Format – Resident and non-resident names

Linear Executable (LE)

An LE module has two name tables, laid out the same way. The resident names stay in memory while the module is loaded; the non-resident names are read from the file only when they are needed. Both give the module’s exported entry points their names, by ordinal: the number of the entry in the entry table.

Name entries

Each table is a run of entries, ended by a length of 0:

OffsetSizeFieldMeaning
01LengthThe length of the name in bytes; 0 ends the table.
1lengthNameThe name, in single-byte characters, with no zero at the end.
1 + length2OrdinalThe entry table ordinal the name belongs to.

Resident names

The resident name table is at the header’s resident name table offset (0x58, from the start of the LE header). Its first entry is the module’s name, with ordinal 0. The names after it are exports that stay in memory.

000001D0  06 52 45 47 56 58 44 00 00 00  .REGVXD...
The resident names of REGVXD.VXD: the module name REGVXD, ordinal 0, then the 0 that ends the table

Non-resident names

The non-resident name table is at a file offset, the header’s 0x88, and the header gives its size in bytes (0x8C). Its first entry is the module’s description, with ordinal 0; the rest are exported names. VxDs export their device descriptor block by name, such as _The_DDB.

00003C5C  14 56 78 44 20 52 45 47 56 58 44 20 28 56 74 6F  .VxD REGVXD (Vto
00003C6C  6F 6C 73 44 29 00 00 08 5F 54 68 65 5F 44 44 42  olsD)..._The_DDB
00003C7C  01 00 00                                         ...
The non-resident names of REGVXD.VXD, 35 bytes: the description “VxD REGVXD (VtoolsD)”, ordinal 0, then _The_DDB, ordinal 1, then the 0 that ends the table

The description shows that the driver was built with VtoolsD, Vireo Software’s toolkit for writing VxDs. The explorer shows the description in the module’s summary, and uses both tables to name the entry points in the code.