Resolving DLL function names using ordinals

Question

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile)

One thing special about that library is the ordlookup folder. It looks like it is mapping ordinals to specific function names for known dlls.

I ran PEfile on a .exe I had and I got in the imports:

"wsock32.dll": {
    "listen": "0x44a560",
    "accept": "0x44a564",
    "htons": "0x44a568",
    "getsockname": "0x44a56c",
    "gethostbyname": "0x44a570",
    "gethostname": "0x44a574",
    "ntohl": "0x44a578",
    "inet_addr": "0x44a57c",
    "ntohs": "0x44a580",
    "ioctlsocket": "0x44a584",
    "recv": "0x44a588",
    "send": "0x44a58c",
    "recvfrom": "0x44a590",
    "sendto": "0x44a594",
    "select": "0x44a598",
    "connect": "0x44a59c",
    "WSACleanup": "0x44a5a0",
    "WSAStartup": "0x44a5a4",
    "inet_ntoa": "0x44a5a8",
    "bind": "0x44a5ac",
    "getpeername": "0x44a5b0",
    "setsockopt": "0x44a5b4",
    "socket": "0x44a5b8",
    "WSAGetLastError": "0x44a5bc",
    "closesocket": "0x44a5c0"
  },

Then I removed the line that allows that ordlookup module to work an re-ran PEfile:

"wsock32.dll": {
    "null": "0x44a5c0"
},

Why do I get two different answer? What are ordinals / what does ordinals do?

Answer 1

You can you the following to get the DLLs:

for entry in pe.DIRECTORY_ENTRY_IMPORT:
    if entry.dll != None:
        print(entry.dll.decode())

Simply put, ordinals are positions of functions in a given DLL. BUT not every ordinal is the same for a given function. The function Sleep sor example has different ordinals depending on the OS version, even the architecture of the system (32 bit / 64 bit). Research and check which function you can safely get by ordinals. I'm not a big expert but I hope this helps.