I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile)

One thing special about that library is the ordlookup folder. It looks like it is mapping ordinals to specific function names for known dlls.

I ran PEfile on a .exe I had and I got in the imports:

"wsock32.dll": {
    "listen": "0x44a560",
    "accept": "0x44a564",
    "htons": "0x44a568",
    "getsockname": "0x44a56c",
    "gethostbyname": "0x44a570",
    "gethostname": "0x44a574",
    "ntohl": "0x44a578",
    "inet_addr": "0x44a57c",
    "ntohs": "0x44a580",
    "ioctlsocket": "0x44a584",
    "recv": "0x44a588",
    "send": "0x44a58c",
    "recvfrom": "0x44a590",
    "sendto": "0x44a594",
    "select": "0x44a598",
    "connect": "0x44a59c",
    "WSACleanup": "0x44a5a0",
    "WSAStartup": "0x44a5a4",
    "inet_ntoa": "0x44a5a8",
    "bind": "0x44a5ac",
    "getpeername": "0x44a5b0",
    "setsockopt": "0x44a5b4",
    "socket": "0x44a5b8",
    "WSAGetLastError": "0x44a5bc",
    "closesocket": "0x44a5c0"

Then I removed the line that allows that ordlookup module to work an re-ran PEfile:

"wsock32.dll": {
    "null": "0x44a5c0"

Why do I get two different answer? What are ordinals / what does ordinals do?

  • 1
    You might have wanted to know "what are ordinals?" before going to work with DLL's – they don't "do" things. Basically, "[t]he export address table [is] an array of length N holding the addresses of the exported functions/data [...] Indexes into this table are called ordinals." (blog.omega-prime.co.uk/?p=115)
    – Jongware
    Commented Jun 17, 2016 at 13:20
  • If there are lots of imports then using ordinals saves space in bin i wrote a ord2name plugin for ollydbg search woodmanns you can get soome pointers if u cant locate comment back and i will see if i can find it
    – blabb
    Commented Jun 18, 2016 at 11:23

1 Answer 1


You can you the following to get the DLLs:

    if entry.dll != None:

Simply put, ordinals are positions of functions in a given DLL. BUT not every ordinal is the same for a given function. The function Sleep sor example has different ordinals depending on the OS version, even the architecture of the system (32 bit / 64 bit). Research and check which function you can safely get by ordinals. I'm not a big expert but I hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.