这不是一个错误的错误,Ordinal Base 不应用于序数表条目,而是应用于序数本身的计算。是的,Microsoft PE 规范(http://msdn.microsoft.com/en-us/library/windows/hardware/gg463119.aspx,第 5.3.4 节)是错误的。这是应该如何进行计算:
i = Search_ExportNamePointerTable(ExportName);
ordinal = ExportOrdinalTable[i] + OrdinalBase; // The "+ OrdinalBase" is missing in the official PE specification
SymbolRVA = ExportAddressTable[ordinal - OrdinalBase];
或者,以不同的方式表达:
i = Search_ExportNamePointerTable(ExportName);
offset = ExportOrdinalTable[i];
SymbolRVA = ExportAddressTable[offset];
ordinal = OrdinalBase + offset;
如果我转储我的 mfc42.dll ......
dumpbin mfc42.dll /exports |more
...这就是我得到的:
Microsoft (R) COFF/PE Dumper Version 12.00.20827.3
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file mfc42.dll
File Type: DLL
Section contains the following exports for MFC42.dll
00000000 characteristics
4D798B26 time date stamp Fri Mar 11 03:38:30 2011
0.00 version
5 ordinal base
6888 number of functions
8 number of names
ordinal hint RVA name
1452 0 000EF5D8 ?AfxFreeLibrary@@YAHPEAUHINSTANCE__@@@Z
1494 1 000EF5A4 ?AfxLoadLibrary@@YAPEAUHINSTANCE__@@PEBD@Z
1497 2 000F8344 ?AfxLockGlobals@@YAXH@Z
1587 3 000F83DC ?AfxUnlockGlobals@@YAXH@Z
7 4 000FC83C DllCanUnloadNow
8 5 000FC7E0 DllGetClassObject
9 6 000FC870 DllRegisterServer
10 7 000FC87C DllUnregisterServer
5 0001C910 [NONAME]
6 0001C8E8 [NONAME]
256 0005DEC0 [NONAME]
257 000423C0 [NONAME]
258 00042400 [NONAME]
259 00042440 [NONAME]
[...]
上面的第 7 个函数(例如)是 DllRegisterServer,它对应于下面 mfc42.dll 的十六进制转储中导出序号表中的第 7 个字(0x0004)。开始是A7 05
。
59 CC 12 00 6B CC 12 00 A7 05 D1 05 D4 05 2E 06
02 00 03 00 04 00 05 00 4D 46 43 34 32 2E 64 6C
计算:
i = Search_ExportNamePointerTable("DllRegisterServer") = 7 - 1 = 6 // zero-based
offset = ExportOrdinalTable[6] = 4
SymbolRVA = ExportAddressTable[4] = ...
ordinal = OrdinalBase + offset = 5 + 4 = 9