Dynamic linking with GetProcAdress using an ordinal?

[ThoughtCriminal]

Where can I find the ordinal?

By dumping the .lib file?

Dumping the .dll file?

Or do both contain ordinals?

Or can one or both have no ordinals?

Please show me what a ordinal looks like in a small section of a dump.

Thank you.

[ThoughtCriminal]

Never mind looking around the web I figured what I was looking for:

Code Select Expand


    ordinal hint RVA      name

          1    0 0001A7F3 AddAtomA
          2    1 0001A7CB AddAtomW
          3    2 000445DA AddConsoleAliasA
          4    3 000445A3 AddConsoleAliasW
          5    4 000453E7 AllocConsole
          .
          .
          .
          .
 


[sinsi]

Remember that ordinals change between Windows versions (and even service packs I think) - using "link /dump /exports kernel32.dll" will give different values for 95 and XP e.g.
95    377  114 0001A4AE GetProcessHeap
XP    411  19A 0000ABC1 GetProcessHeap