Has ordinal index of functions in Windows API dlls ever changed?
Posted
by
Panda
on Stack Overflow
See other posts from Stack Overflow
or by Panda
Published on 2010-12-26T08:19:13Z
Indexed on
2010/12/26
9:54 UTC
Read the original article
Hit count: 212
You know that functions in a dll can be imported either by name or by ordinal index.
From wikipedia: For most Windows API functions only the names are preserved across different Windows releases; the ordinals are subject to change. Thus, one cannot reliably import Windows API functions by their ordinals.
My Question: I know these ordinals MAY CHANGE, but I want to know if they've ever ACTUALLY CHANGED. (Especially about kernel32 & user32 dlls)
Why I'm asking this? I heard some viruses do import win32 functions by ordinal. I want to catch them, and I want to know whether I can test for an ordinal number or not.
Thanks.
© Stack Overflow or respective owner