Click here to Skip to main content
15,907,687 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: ONCREAECLIENT Pin
ashish dogra4-Jul-06 0:37
ashish dogra4-Jul-06 0:37 
QuestionCopyFile Pin
hafz3-Jul-06 23:08
hafz3-Jul-06 23:08 
AnswerRe: CopyFile Pin
Weiye Chen3-Jul-06 23:10
Weiye Chen3-Jul-06 23:10 
AnswerRe: CopyFile Pin
Hamid_RT4-Jul-06 2:21
Hamid_RT4-Jul-06 2:21 
QuestionHow to create ActiveX like SDI application? Pin
safety_ruk3-Jul-06 23:05
safety_ruk3-Jul-06 23:05 
Questionabout circular button(owner draw) Pin
HOW WHAT3-Jul-06 23:00
HOW WHAT3-Jul-06 23:00 
AnswerRe: about circular button(owner draw) Pin
Sarath C4-Jul-06 0:30
Sarath C4-Jul-06 0:30 
QuestionFinding the Ordinal of an imported function Pin
capricious_0013-Jul-06 22:36
capricious_0013-Jul-06 22:36 
Hi guys,

I was wondering how someone would find the Ordinal of an imported function? I am using an API hook function which is below:

PVOID HookImportedFunction(const char *Dll, const char *FuncName, int Ordinal, void *Function)
{
    DWORD oldProtect;
	void *PrevValue=0;

    DWORD image_base = (DWORD)GetModuleHandle(NULL);
    IMAGE_DOS_HEADER *idh = (IMAGE_DOS_HEADER *)image_base;
    IMAGE_FILE_HEADER *ifh = (IMAGE_FILE_HEADER *)(image_base +
        idh->e_lfanew + sizeof(DWORD));
    IMAGE_OPTIONAL_HEADER *ioh = (IMAGE_OPTIONAL_HEADER *)((DWORD)(ifh) +
        sizeof(IMAGE_FILE_HEADER));
    IMAGE_IMPORT_DESCRIPTOR *iid = (IMAGE_IMPORT_DESCRIPTOR *)(image_base +
        ioh->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

    VirtualProtect((LPVOID)(image_base +
        ioh->DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress),
        ioh->DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size, PAGE_READWRITE,
        &oldProtect);

    while(iid->Name)
    {
        if(stricmp(Dll, (char *)(image_base + iid->Name)) == 0)
        {
            //trace_printf("Found descriptor: %s\n", dhook->name);
            IMAGE_THUNK_DATA * pThunk = (IMAGE_THUNK_DATA *)
                ((DWORD)iid->OriginalFirstThunk + image_base);
            IMAGE_THUNK_DATA * pThunk2 = (IMAGE_THUNK_DATA *)
                ((DWORD)iid->FirstThunk + image_base);
            while(pThunk->u1.AddressOfData)
            {
                char * name = 0;
                int ordinal;
                // Imported by ordinal only:
                if(pThunk->u1.Ordinal & 0x80000000)
                    ordinal = pThunk->u1.Ordinal & 0xffff;
                else    // Imported by name, with ordinal hint
                {
                    IMAGE_IMPORT_BY_NAME * pname = (IMAGE_IMPORT_BY_NAME *)
                        ((DWORD)pThunk->u1.AddressOfData + image_base);
                    ordinal = pname->Hint;
                    name = (char *)pname->Name;
                }

                if(name != 0 && FuncName && strcmp(name, FuncName) == 0)
                {
                    //trace_printf("Found entry name: %s\n", ehook->name);
					PrevValue = (void*)pThunk2->u1.Function;
#if _MFC_VER == 0x0600
                    pThunk2->u1.Function = (DWORD*)Function;
#else
                    pThunk2->u1.Function = (DWORD)Function;
#endif
                }
                else if(ordinal == Ordinal)
                {
                    //trace_printf("Found entry ordinal: %s\n", ehook->name);
					PrevValue = (void*)pThunk2->u1.Function;
#if _MFC_VER == 0x0600
                    pThunk2->u1.Function = (DWORD*)Function;
#else
                    pThunk2->u1.Function = (DWORD)Function;
#endif
                }

				pThunk++;
                pThunk2++;
            }
		}
        iid++;
    }
	return PrevValue;
}


However I do not know how to get the Ordinal of a windows API function, say CreateFile or WriteProcessMemory. I know an ordinal of the function MessageBoxA is 476, but I cant find the ordinals of these functions.

Would anyone know how you would find the ordinals?

Thanks,

Robbie
AnswerRe: Finding the Ordinal of an imported function Pin
Viorel.3-Jul-06 23:53
Viorel.3-Jul-06 23:53 
GeneralRe: Finding the Ordinal of an imported function Pin
capricious_0014-Jul-06 0:09
capricious_0014-Jul-06 0:09 
QuestionProblems with LaserJet driver Pin
quique3-Jul-06 21:55
quique3-Jul-06 21:55 
AnswerRe: Problems with LaserJet driver Pin
Hamid_RT3-Jul-06 22:08
Hamid_RT3-Jul-06 22:08 
GeneralRe: Problems with LaserJet driver Pin
quique4-Jul-06 0:46
quique4-Jul-06 0:46 
GeneralRe: Problems with LaserJet driver Pin
Hamid_RT4-Jul-06 2:20
Hamid_RT4-Jul-06 2:20 
GeneralRe: Problems with LaserJet driver Pin
quique4-Jul-06 4:53
quique4-Jul-06 4:53 
GeneralRe: Problems with LaserJet driver Pin
Hamid_RT4-Jul-06 5:52
Hamid_RT4-Jul-06 5:52 
GeneralRe: Problems with LaserJet driver Pin
quique4-Jul-06 21:29
quique4-Jul-06 21:29 
Questionhow to read an RTF file containing a bitmap and text Pin
Chetan Sheladiya3-Jul-06 21:49
professionalChetan Sheladiya3-Jul-06 21:49 
AnswerRe: how to read an RTF file containing a bitmap and text Pin
Hamid_RT3-Jul-06 21:56
Hamid_RT3-Jul-06 21:56 
Questiondecimal digits Pin
thathvamsi3-Jul-06 21:47
thathvamsi3-Jul-06 21:47 
AnswerRe: decimal digits Pin
Weiye Chen3-Jul-06 21:51
Weiye Chen3-Jul-06 21:51 
GeneralRe: decimal digits Pin
thathvamsi3-Jul-06 22:05
thathvamsi3-Jul-06 22:05 
GeneralRe: decimal digits Pin
Weiye Chen3-Jul-06 22:29
Weiye Chen3-Jul-06 22:29 
GeneralRe: decimal digits Pin
thathvamsi3-Jul-06 22:38
thathvamsi3-Jul-06 22:38 
GeneralRe: decimal digits Pin
Weiye Chen3-Jul-06 22:59
Weiye Chen3-Jul-06 22:59 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.