LOLBAS icon indicating copy to clipboard operation
LOLBAS copied to clipboard

Add DLL export ordinals to LOLLibs

Open wietze opened this issue 2 years ago • 0 comments

For every entry relying on a DLL with an entry point, it would be good if we could also record the corresponding ordinal.

For example, comsvcs.dll can be used to dump memory via:

rundll32 C:\windows\system32\comsvcs.dll MiniDump [LSASS_PID] dump.bin full

However, the following also works:

  rundll32 C:\windows\system32\comsvcs.dll #24 [LSASS_PID] dump.bin full
image

Therefore, somehow recording all corresponding ordinals for each entry point we mention, would be a nice addition.

wietze avatar May 06 '22 13:05 wietze