Has ordinal index of functions in Windows API dlls ever changed?
- by Panda
You know that functions in a dll can be imported either by name or by ordinal index.
From wikipedia: For most Windows API functions only the names are preserved across different Windows releases; the ordinals are subject to change. Thus, one cannot reliably import Windows API functions by their ordinals.
My Question: I know these ordinals MAY CHANGE, but I want to know if they've ever ACTUALLY CHANGED. (Especially about kernel32 & user32 dlls)
Why I'm asking this? I heard some viruses do import win32 functions by ordinal. I want to catch them, and I want to know whether I can test for an ordinal number or not.
Thanks.