1

I am trying to figure out how to get the imports of a PE using the PEfile python project (https://github.com/erocarrera/pefile)

One thing special about that library is the ordlookup folder. It looks like it is mapping ordinals to specific function names for known dlls.

I ran PEfile on a .exe I had and I got in the imports:

"wsock32.dll": {
    "listen": "0x44a560",
    "accept": "0x44a564",
    "htons": "0x44a568",
    "getsockname": "0x44a56c",
    "gethostbyname": "0x44a570",
    "gethostname": "0x44a574",
    "ntohl": "0x44a578",
    "inet_addr": "0x44a57c",
    "ntohs": "0x44a580",
    "ioctlsocket": "0x44a584",
    "recv": "0x44a588",
    "send": "0x44a58c",
    "recvfrom": "0x44a590",
    "sendto": "0x44a594",
    "select": "0x44a598",
    "connect": "0x44a59c",
    "WSACleanup": "0x44a5a0",
    "WSAStartup": "0x44a5a4",
    "inet_ntoa": "0x44a5a8",
    "bind": "0x44a5ac",
    "getpeername": "0x44a5b0",
    "setsockopt": "0x44a5b4",
    "socket": "0x44a5b8",
    "WSAGetLastError": "0x44a5bc",
    "closesocket": "0x44a5c0"
  },

Then I removed the line that allows that ordlookup module to work an re-ran PEfile:

"wsock32.dll": {
    "null": "0x44a5c0"
},

Why do I get two different answer? What are ordinals / what does ordinals do?

  • 1
    You might have wanted to know "what are ordinals?" before going to work with DLL's – they don't "do" things. Basically, "[t]he export address table [is] an array of length N holding the addresses of the exported functions/data [...] Indexes into this table are called ordinals." (blog.omega-prime.co.uk/?p=115) – usr2564301 Jun 17 '16 at 13:20
  • If there are lots of imports then using ordinals saves space in bin i wrote a ord2name plugin for ollydbg search woodmanns you can get soome pointers if u cant locate comment back and i will see if i can find it – blabb Jun 18 '16 at 11:23
1

You can you the following to get the DLLs:

for entry in pe.DIRECTORY_ENTRY_IMPORT:
    if entry.dll != None:
        print(entry.dll.decode())

Simply put, ordinals are positions of functions in a given DLL. BUT not every ordinal is the same for a given function. The function Sleep sor example has different ordinals depending on the OS version, even the architecture of the system (32 bit / 64 bit). Research and check which function you can safely get by ordinals. I'm not a big expert but I hope this helps.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.