The GPAManualByOrdinal function aims to find a specific function within a module's Export Address Table (EAT) using its ordinal number rather than its name. This is particularly useful when you know the ordinal of a function but not its name, or when dealing with functions that do not have names in their export table.
Function Definition and Parameters
The GPAManualByOrdinal function takes two parameters:
- HMODULE moduleBase: A handle to the base address of the DLL.
- WORD ordinal: The ordinal number of the function you want to find.
Here's a step-by-step breakdown of how this function works:
Step 1: Validate Headers
Similar to GPAManualByName, the first step is to validate the DOS and NT headers:
c1PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)moduleBase; 2if (dos->e_magic != IMAGE_DOS_SIGNATURE) 3 return NULL; 4 5PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(moduleBase + dos->e_lfanew); 6if (nt->Signature != IMAGE_NT_SIGNATURE) 7 return NULL;
Step 2: Locate the Export Directory
Next
Read the full article at InfoSec Write-ups - Medium
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



