LOLBAS
LOLBAS copied to clipboard
Add DLL export ordinals to LOLLibs
For every entry relying on a DLL with an entry point, it would be good if we could also record the corresponding ordinal.
For example, comsvcs.dll
can be used to dump memory via:
rundll32 C:\windows\system32\comsvcs.dll MiniDump [LSASS_PID] dump.bin full
However, the following also works:
rundll32 C:\windows\system32\comsvcs.dll #24 [LSASS_PID] dump.bin full

Therefore, somehow recording all corresponding ordinals for each entry point we mention, would be a nice addition.