flat assembler
Message board for the users of flat assembler.

Index > Windows > DLL import by ordinals - is it safe ?

Author
Thread Post new topic Reply to topic
IronFelix



Joined: 09 Dec 2004
Posts: 141
Location: Russia, Murmansk region
IronFelix
Hi all!
Please tell me, is it safe to import system DLL's functions by ordinals instead of names? Do that ordinals got changed between DLL's releases or not? I'm asking because with ordinals import table will be definitly smaller rather than with names.

Thanks.

_________________
Flat Assembler is the best!
Post 21 Apr 2009, 15:09
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17662
Location: In your JS exploiting you and your system
revolution
Not safe. Don't waste your time trying it, MS don't support or guarantee the stability of the ordinals.
Post 21 Apr 2009, 17:12
View user's profile Send private message Visit poster's website Reply with quote
IronFelix



Joined: 09 Dec 2004
Posts: 141
Location: Russia, Murmansk region
IronFelix
Thank you, revolution. So, ordinals are for applications "inner" use only? Does any application have DLLs with fixed ordinals?
Post 22 Apr 2009, 06:52
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17662
Location: In your JS exploiting you and your system
revolution
IronFelix wrote:
So, ordinals are for applications "inner" use only?
I guess so. Unless you feel like restricting your app to only one patch level of Windows.
IronFelix wrote:
Does any application have DLLs with fixed ordinals?
I'm sure there are some. Most probably when people/companies think that obfuscation is a good idea or in a situation where faster launching is a must have.
Post 22 Apr 2009, 08:19
View user's profile Send private message Visit poster's website Reply with quote
pal



Joined: 26 Aug 2008
Posts: 227
pal
If you mean ordinal numbers, which I assume you do, there are some hidden Windows APIs which you can only call by using ordinal numbers, you also have to try to figure out what each API does and what parameters it takes. MS does not like you using these, they're meant to be better/faster than the standard APIs so that Windows performs better/faster than your application.
Post 22 Apr 2009, 09:48
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17662
Location: In your JS exploiting you and your system
revolution
pal wrote:
If you mean ordinal numbers, which I assume you do, there are some hidden Windows APIs which you can only call by using ordinal numbers, you also have to try to figure out what each API does and what parameters it takes. MS does not like you using these, they're meant to be better/faster than the standard APIs so that Windows performs better/faster than your application.
[wiki]citation needed[/wiki].

Any conspiracy theorists around here?
Post 22 Apr 2009, 10:30
View user's profile Send private message Visit poster's website Reply with quote
pal



Joined: 26 Aug 2008
Posts: 227
pal
I was gonna ask for some citation from anyone.

Code:
http://www.thevbzone.com/secrets.htm#Hidden    


VB API declarations for a few hidden ones.

Code:
http://www.inlumineconsulting.com:8080/website/nt.sekrits.html    


More to do with NT APIs than anything else.
Post 22 Apr 2009, 11:58
View user's profile Send private message Reply with quote
Goplat



Joined: 15 Sep 2006
Posts: 181
Goplat
Most DLLs have the ordinal numbers change every version, but there are actually a few where the ordinal numbers are stable. wsock32.dll is one example.
Post 22 Apr 2009, 14:35
View user's profile Send private message Reply with quote
pete



Joined: 20 Apr 2009
Posts: 110
pete
Interesting links, thanks pal!
Post 22 Apr 2009, 15:02
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.