Has ordinal index of functions in Windows API dlls ever changed?

Posted by Panda on Stack Overflow See other posts from Stack Overflow or by Panda
Published on 2010-12-26T08:19:13Z Indexed on 2010/12/26 9:54 UTC
Read the original article Hit count: 212

Filed under:
|
|

You know that functions in a dll can be imported either by name or by ordinal index.

From wikipedia: For most Windows API functions only the names are preserved across different Windows releases; the ordinals are subject to change. Thus, one cannot reliably import Windows API functions by their ordinals.

My Question: I know these ordinals MAY CHANGE, but I want to know if they've ever ACTUALLY CHANGED. (Especially about kernel32 & user32 dlls)

Why I'm asking this? I heard some viruses do import win32 functions by ordinal. I want to catch them, and I want to know whether I can test for an ordinal number or not.

Thanks.

© Stack Overflow or respective owner

Related posts about Windows

Related posts about api