Coding With Fun
Home Docker Django Node.js Articles Python pip guide FAQ Policy

How to export address table and export ordinals?


Asked by Amira Henderson on Dec 03, 2021 FAQ



Export Names Table > Export Ordinals Table -> Export Address Table = Function Address (VA). This should make it clear how the OS Loader gets to know the addresses of Functions which are imported by the main module from these loaded modules. Let's say, I want to view all the functions exported by the GDI32.dll module.
In this manner,
When the function is exported by an ordinal, we can directly use the ordinal number as an index into the AddressOfFunctions array if the Base number is 0. In our case, the Base number is 1, which means that we have to take the ordinal number and subtract the Base number (which is 1 in this case) from it.
Next, With an export ordinal, GetProcAddress can locate the function directly as opposed to comparing the specified name to the function names in the DLL's export table. However, you should call GetProcAddress with an export ordinal only if you have control over assigning the ordinals to the exported functions in the .def file.
Thereof,
The export name pointer table and the export ordinal table form two parallel arrays that are separated to allow natural field alignment.
Just so,
To find the address of the Export Table, we add kernel32 base address 75690000 and Export Table RVA 972C0 which results in the address 757272C0: Let's add Export Table address 757272C0 and the offset 0x14, which equals to 0x757272D4.