Timeline for How to know if PE Header import function is being imported by Ordinal rather than by name
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 2, 2016 at 16:56 | review | Close votes | |||
| Sep 3, 2016 at 7:21 | |||||
| Aug 28, 2016 at 13:00 | vote | accept | Majiick | ||
| Aug 28, 2016 at 7:33 | answer | added | knx | timeline score: 4 | |
| S Aug 28, 2016 at 6:20 | history | suggested | knx | CC BY-SA 3.0 |
corrected typos IMAGE_IMPORT_DESCRIPTIORS
|
| Aug 28, 2016 at 6:18 | review | Suggested edits | |||
| S Aug 28, 2016 at 6:20 | |||||
| Aug 28, 2016 at 6:13 | comment | added | Majiick | I found something relevant on page 51 of Windows' pe header documentation under the topic "Import Lookup Table", gyazo.com/0fde0a89b514b3e40a163e9934391e4f Looks like the first bit of the IMAGE_THUNK_DATA->Ordinal is a flag, and if it is set then the function should be imported by ordinal. It's late right now, I will write the answer tomorrow or someone else write it. | |
| Aug 28, 2016 at 4:36 | history | edited | Majiick | CC BY-SA 3.0 |
added 1294 characters in body
|
| Aug 28, 2016 at 4:13 | history | asked | Majiick | CC BY-SA 3.0 |