avast / avast/retdec

API Ordinals differ in each Windows version; retdec decompiler may assign wrong function names

Open
#1,005 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

There are reverse conversion tables (import ordinal -> import name) in files like `support\ordinals\x86\kernel32.ord`. During decompilation, they convert functions imported by ordinal into a human-readable API name. Some of them probably come from 16-bit Windows (`support\ordinals\x86\kernel.ord`). At that time, import by ordinal was Microsoft-recommended way to import APIs.

Since introduction of 32-bit Windows, import by ordinal is no longer recommended. In fact, ordinal numbers are not guaranteed to be constant across Windows versions. An example is [this regression test](https://github.com/avast/retdec-regression-tests/blob/master/features/exotic-pe/imports_tinyW7.ex), which originates from [Corkami's](https://github.com/corkami/pocs/blob/master/PE/imports_tinyW7.asm) collection. The author meant to call `msvcrt!printf`, followed by `kernel32!ExitProcess`. Both these APIs are imported by ordinal.

As the ordinal numbers shifted over time, the sample now calls `msvcrt!iswspace` a `KERNELBASE!AfpAdminDisconnect` (Windows 10 build 19041).

If you ask the "Why no one noticed this earlier" question, this is because normally, in 32/64-bit Windows, API names are almost never imported by ordinal, except for `WS2_32.dll`, `OLE32.dll`, few from `COMCTL32.dll` and possibly some others. The above mentioned sample is artificially created in a way that linkers would never do.

TLDR: Majority of the `ordinal->name` tables are worthless; moreover they may create misleading information by assigning wrong API names.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the reverse-conversion tables under support\ordinals\x86\, especially kernel32.ord and kernel.ord, and reproduce the behavior with the imports_tinyW7.ex regression test. Compare the ordinal mappings with the Windows-version behavior described in the issue; done should mean the sample's ordinal imports are not assigned misleading API names.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.