BN: parse forwarded exports

[williballenthin]

implement support for forwarded export featueres #1624 for Binary Ninja.

fyi @xusheng6

[williballenthin]

the Binary Ninja UI doesn't show symbols for the forwarded exports in ea2876e9175410b6f6719f80ee44b9553960758c7d0f7bed73c0fe9a78d8e669, so i'm not sure if this will be easy/feasible without manually parsing the input file/export table.

[xusheng6]

Some relevant info on export forwarding: https://devblogs.microsoft.com/oldnewthing/20121116-00/?p=6073

[xusheng6]

Honestly this is the first time I have heard about DLL export forwarding. I will see if BN's PE parser actually support this (unlikely), and what would be the best way to handle it

[xusheng6]

@williballenthin If you go to the Triage view, and view the Exports, you can see the exports are marked with __forwarder_name. This means BN parses the info correctly.

[williballenthin]

ah great, i'll study the API a bit further with this background and propose an implementation. thanks @xusheng6

[williballenthin]

sidebar: forwarded exports are not really something that probably have much use for a code inspection tool like BN, but it's nice that the parser does handle them already.

[xusheng6]

ah great, i'll study the API a bit further with this background and propose an implementation. thanks @xusheng6

Thanks for looking into that. The code that adds the symbol is here: https://github.com/Vector35/view-pe/blob/0efedb740ff54e610f33091f43407a20a03bdafc/peview.cpp#L2124. Looks like you can add some code when export functions are processed and scan for such names

[xusheng6]

@williballenthin and this can be closed as well :)