The Ministry of Silly Walks Presents: Walking the PEB

The GPAManualByOrdinal function aims to find a specific function within a module's Export Address Table (EAT) using its ordinal number rather than its name. This is particularly useful when you know the ordinal of a function but not its name, or when dealing with functions that do not have names in their export table.

Function Definition and Parameters

The GPAManualByOrdinal function takes two parameters:

1. HMODULE moduleBase: A handle to the base address of the DLL.
2. WORD ordinal: The ordinal number of the function you want to find.

Here's a step-by-step breakdown of how this function works:

Step 1: Validate Headers

Similar to GPAManualByName, the first step is to validate the DOS and NT headers:

c
 
1PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)moduleBase;
2if (dos->e_magic != IMAGE_DOS_SIGNATURE)
3    return NULL;
4
5PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(moduleBase + dos->e_lfanew);
6if (nt->Signature != IMAGE_NT_SIGNATURE)
7    return NULL;

Step 2: Locate the Export Directory

Next

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.