Print Page - Dynamic linking with GetProcAdress using an ordinal?

Title: Dynamic linking with GetProcAdress using an ordinal?
Post by: ThoughtCriminal on August 11, 2007, 04:39:32 AM

Where can I find the ordinal?

By dumping the .lib file?

Dumping the .dll file?

Or do both contain ordinals?

Or can one or both have no ordinals?

Please show me what a ordinal looks like in a small section of a dump.

Thank you.

Title: Re: Dynamic linking with GetProcAdress using an ordinal?
Post by: ThoughtCriminal on August 11, 2007, 05:17:58 AM

Never mind looking around the web I figured what I was looking for:

Code Select


    ordinal hint RVA      name

          1    0 0001A7F3 AddAtomA
          2    1 0001A7CB AddAtomW
          3    2 000445DA AddConsoleAliasA
          4    3 000445A3 AddConsoleAliasW
          5    4 000453E7 AllocConsole
          .
          .
          .
          .

Title: Re: Dynamic linking with GetProcAdress using an ordinal?
Post by: sinsi on August 11, 2007, 05:57:58 AM

Remember that ordinals change between Windows versions (and even service packs I think) - using "link /dump /exports kernel32.dll" will give different values for 95 and XP e.g.
95 377 114 0001A4AE GetProcessHeap
XP 411 19A 0000ABC1 GetProcessHeap

The MASM Forum Archive 2004 to 2012

General Forums => The Campus => Topic started by: ThoughtCriminal on August 11, 2007, 04:39:32 AM