THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Summary

PE loading currently adds exports before COFF symbols. At a shared address, the later COFF spelling (for example, _Name) can displace the public export spelling (Name). At the same time, every non-forwarded export is classified as a function, so exported data loses the object information already present in the COFF table.

This change:

• loads COFF symbols before exports so the public export name remains canonical;
• uses a COFF type hint only when exactly one external, concrete FUNCTION or OBJECT definition exists at that RVA;
• keeps ordinary static/local COFF symbols available without letting them influence export typing;
• retains the existing FUNCTION fallback for absent or conflicting hints and for forwarded exports; and
• preserves PDB precedence by continuing to load PDB symbols last.

The behavior is confined to the PE backend; it does not change global symbol alias ordering for ELF or other formats.

DecBench results

I evaluated the three Dexter PE builds in DecBench. Each build has 104 unambiguous export/COFF matches (61 functions and 43 objects).

• Exact source-name recovery for the evaluated exported functions: 0/180 before → 180/180 after (60 per build). The one decorated DetectShutdown spelling per build was excluded from this exact-name count and remains conservatively unchanged.
• CFG recovery and decompilation success were unchanged in all three builds.
• Representative decompiled types were unchanged; the fix changes symbol identity/type metadata rather than control-flow recovery.

A broader scan of 101 DecBench PE binaries found 3,453 exports. The change applies to 312 unambiguous matches (183 functions and 129 objects); the other 3,141 exports remain on the existing behavior. The scan found no conflicting-type acceptance, duplicate-address mismatch, or ordinal-only-name change.

Regression coverage

The new fixture-free tests construct minimal PE/COFF inputs and cover function and object inheritance, same-address public-name precedence, local/static-symbol exclusion, ambiguity fallback, missing-hint fallback, and forwarded-export fallback.

Validation:

• focused PE/COFF tests: 16 passed;
• complete CLE suite: 202 passed, 9 skipped;
• complete workspace gate: archinfo 17 passed; pypcode 46 passed plus 187 subtests; pyvex 63 passed; claripy 331 passed/1 skipped; angr 2,221 passed/46 skipped/2 expected xfails plus 188 subtests; angr Rust 30 passed; angr-management 500 passed.