___                   ____            ___                  _
 _/  /______   ________ /   /_ ___  _ __/ _/______ __  _ ___\\/_      ___
_)  _      /___\_     //    _//  /_____.  \_     // /_____.    (_ ____\  \
\   \     /     /    /      \   _/     |   /    /  _/     |     /     ___/___
/_________\    /    /________\  \      |________\  \      |_____\     \     /
- -diP---_ __    ___\------_ ____\_____|------_ ____\_____|----_ ___________\-
             \___\  NEWS - RELEASES - TOOLS - ARTICLES - MEMBERS - LINKS

Generating import by ordinal executables with Visual C++
by SpaceCommander / ByTeGeiZ

Last Changes: 03.11.2003


Introduction


This article explains how to set up an Visual C++ project that imports all funtions by ordinal.


Needed tools

  • example project from article "Generating small executables with
    Visual C++"
  • dumpbin.exe from "Microsoft Visual Studio\VC98\Bin"
  • lib.exe from "Microsoft Visual Studio\VC98\Bin"

Looking for imports


To find out the imports of our sample.exe we call dumpbin:

    dumpbin /imports sample.exe

    Microsoft (R) COFF Binary File Dumper Version 6.00.8447
    Copyright (C) Microsoft Corp 1992-1998. All rights reserved.


    Dump of file sample.exe

    File Type: EXECUTABLE IMAGE

      Section contains the following imports:

        USER32.dll
                    402000 Import Address Table
                    402030 Import Name Table
                         0 time date stamp
                         0 Index of first forwarder reference

                     1BE  MessageBoxA

      Summary

            1000 .data
            1000 .rdata
            1000 .text

We see that our sample.exe has just one import: MessageBoxA of USER32.dll


Looking for exports


In next step we have to find out all exports of all used dlls:

    dumpbin /exports c:\winnt\system32\user32.dll > c:\exports.txt

Now have a look at c:\exports.txt and search for a line containing MessageBoxA:

            452  1C3 00023259 MessageBoxA

The first number is the ordinal we are looking for. This number is different on different windows versions! So our final executable that uses import by ordinal will just run on systems where this ordinal shows to the same function name (Same windows version and service pack level).


Generating an import library


Create a new file called user32.def with following content:

    LIBRARY USER32.dll

    EXPORTS
        MessageBoxA@16 @452 NONAME

Now we need to call lib.exe to generate a .lib file of this .def file:

    lib.exe /machine:ix86 /def:user32.def /out:user32.lib

    Microsoft (R) Library Manager Version 6.00.8447
    Copyright (C) Microsoft Corp 1992-1998. All rights reserved.

       Bibliothek user32.lib und Objekt user32.exp wird erstellt

Copy the generated user32.lib file to your project folder and rebuild your project. Take a look at your executable and you will not find the text MessageBoxA in the executable anymore :)


Contact

SpaceCommander(at)ByTeGeiZ.de