The Export Address Table contains the address of exported entry points and exported data and absolutes. An ordinal number is used to index the Export Address Table, after subtracting the value of the Ordinal Base field to get a true, zero-based index. (Thus, if the Ordinal Base is set to 1, a common value, an ordinal of 6 is the same as a zero-based index of 5.)
Each entry in the Export Address Table is a field that uses one of two formats, as shown in the following table. If the address specified is not within the export section (as defined by the address and length indicated in the Optional Header), the field is an Export RVA: an actual address in code or data. Otherwise, the field is a Forwarder RVA, which names a symbol in another DLL.
Offset | Size | Field | Description |
0 | 4 | Export RVA | Address of the exported symbol when loaded into memory, relative to the image base. For example, the address of an exported function. |
0 | 4 | Forwarder RVA | Pointer to a null-terminated ASCII string in the export section, giving the DLL name and the name of the export (for example, "MYDLL..expfunc") or the DLL name and an export (for example, "MYDLL.#27"). |
A Forwarder RVA exports a definition from some other image, making it appear as if it were being exported by the current image. Thus the symbol is simultaneously imported and exported.
For example, in KERNEL32.DLL in Windows NT, the export named "HeapAlloc" is forwarded to the string "NTDLL.RtlAllocateHeap". This allows applications to use the NT-specific module "NTDLL.DLL" without actually containing import references to it. The application's import table references only "KERNEL32.DLL." Therefore, the application is not specific to Windows NT and can run on any Win32 system.