Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add API features for ws2_32 ordinals #893

Merged
merged 1 commit into from
Apr 23, 2024
Merged

Conversation

williballenthin
Copy link
Collaborator

@williballenthin williballenthin commented Apr 23, 2024

Programs can import networking routines from ws2_32 by ordinal, and this is occasionally seen in the wild, such as in PMA 01-01.dll.

This file shows an example of mapping ordinals to names for ws2_32: https://github.com/phracker/HopperScripts/blob/9468cdadb2c139d474662ae82716a5098e7350e4/WS2_32.dll%20Ordinals%20to%20Names.py#L8

Today, we rely on vivisect (or the binary analysis backend) to resolve ordinal numbers to human-readable names; however, not all analysis backends may have this mapping. So, we can extend our rules to also match these ordinals.

For example, with these changes using a backend that doesn't support ordinal mapping:

image

@williballenthin williballenthin added the enhancement New feature or request label Apr 23, 2024
@mr-tz
Copy link
Collaborator

mr-tz commented Apr 23, 2024

Good idea. Alternatively, we'd have to add special logic to translate names to ordinals and vice versa.

@williballenthin williballenthin merged commit 2c5c0ae into master Apr 23, 2024
7 checks passed
@williballenthin williballenthin deleted the wsa-ordinals branch April 23, 2024 12:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants