Hello and welcome to the lecture hall and P. Peter, there we are going to look at the export directory
structure, which forms her, but her behavior in order to study the behavior.
We are going to use contrary to the DSM VI opening in a tool called Be there and look at the behavior.
You're also going to open a file called Win A. The Hague, who he's an important data file.
He comes star, if you we to studio two or one night.
And it is found in this location.
The country to deal can be found in this location.
So on the left of this diagram, I have open win and header file in notepad plus press and I search
for a structure called the export that a tree structure.
This is per day three structure forms, but I'll be there on the right.
You can see that I used to be there to open country to Darndale and I clicked on the optional heater
to.
This shows the export directory structure, which is just one.
And then if you wanted to view the raw hex values of the memory location, you can rectly this address
here.
This is the reality and virtual address, if you right click on this, you will open up the memory of
that dot panel and then you can examine the raw values experience day and you will be able to analyze
and see that all of these values here correspond to this structure and the left here.
So we are going to do this later on when we do the practical session.
No, I'm just showing you the theoretical background knowledge, which you need to know before we went
to the practical on this.
No, this is not a dying game.
Showing the same to fans, but on the right, I now click on the expert step, as you can see export
stem.
So the experts that will show you in a human readable form what is on top.
And this is easier to understand, and you can actually find the correlation between this and this.
So you can see.
The first member of the expert directory structure is characteristics.
And here you can see characteristics and the value is zero and you can see any very zero.
For base all zeros, and then the second member is timely STEM, as you can see on the right timely
stem and the value is in Hex Phi Phi for the cc1 one fight, which corresponds to this.
In reverse, he caused a little engine in CPU, in castleview memory, in reverse order.
So you realize two zero five five 40 60.
So he should be here five for the cc1 fight, which is this.
And in the 10 member, he's worked major abortion and you can see a major zero referring to this work
he still buys.
And then in this, a minor machine.
He also you can see minor version zero, which refers to these two by here.
And you can go on down and analyze it this way.
On the left is your south school.
On the right is your hex view of the EPI area.
So let's try to understand how the appeal or the results of how she names when the program wants to
run the bill, they will look to file into memory.
And part of the process of loading the file involves trying to resolves the function needs in over on
this.
In this diagram, on the top left hand corner is the export directory structure, which is taken from
here and then on the.
Bottom right corner here, I spend it issue these three members into a easier to understand diagram
you.
So this one here.
Address functions refers to this diagram here.
And this is a function address.
So each of these values start in here addresses, for example, in Hex two or three, four or five and
so on.
And this is a list of all the functions that I supported by this particular deal and the need for this
array is a spot on this table.
In Haiti, he signed his address and names through presenter here.
So all these are name strings, their addresses to strings, for example, right?
Process memory.
So these are all human readable strings, which I use and zero to represent the strings and one and
two and so on.
And one of these could be see right process memory and that one could be get proper dress exciting could
be get more you handle and so on and so forth.
So these are the names which are string entire functions.
And then the next array here down here, I call the ordinance ordinance.
I just numbers to represent the.
Strings.
So the first thing may be represents memory having none zero, and then here my have and get progress.
You one is on.
So why do we need to have this ordinance, so the ordinance, how to make the functional dress?
So for example, if the builder wants to find a particular function name in tree, so hippie lawyer
will go to his nearest array and then look through each of the member of the array until he finds entry.
Once you find a new entry, entry could be repossessed maybe five ember and then you will go down to
the ordinance tree and look for the corresponding ordinance for entry.
So you will find that the ordinance entries fight.
So once it finds the ordinance for entry, you can then go to the following address array and look up.
Five.
So Fyfe will be here.
Zero one two three four five.
So if we get a dress for, I process memory entry.
So this is how many people a resource function needs.
It is also important to remember to know what is the meaning of base this year means to that.
What is the starting ordinal number for this is why they actually are in a burning need.
Not although this is just a 012 chief, I hear sometimes because you have a base which is non-zero.
You have to add it to this.
So if your base is to, then you had to do this.
And then from here you get the actual if, let's say, you know, the order number and you want to find
the actual ordinary here, here to minus, from here you have a 10 and you want to locate in this structure.
So you have to take 10 minus your base address base on, you know, which is two.
So 10 minus two, is it?
So from there you go to eight.
So you get it.
So you go here and look for it.
There you have a point of view to this address.
So this is how the order results from a few names.
So it is how the people there these are Spanish units in the next video will do a practical walkthrough
on this.
So I'll see you in the next one.
Thank you for watching.