'The imported api names recognized by ida are inconsistent

I analyzed two samples, they both import the gethostname function of ws2_32, but in the .idata segment, ida recognizes it as the correct gethostname and __imp__gethostname respectively.

enter image description here enter image description here

I used dumpbin /imports to view the import tables of the two samples respectively, and found that they both only show the API's ordinal number.

WS2_32.dll
            409188 Import Address Table
            40955C Import Name Table
                 0 time date stamp
                 0 Index of first forwarder reference

                  Ordinal    12
                  Ordinal    52
                  Ordinal    57
                  Ordinal    15
                  Ordinal   115

WININET.dll
            40915C Import Address Table
            409530 Import Name Table
                 0 time date stamp
                 0 Index of first forwarder reference

               56 InternetCloseHandle
               75 InternetQueryOptionA
               6F InternetOpenA
               49 HttpSendRequestA

my questions are:

  1. Why does ida get two different names when their import table is the same?
  2. I found that except ws2_32, other dll import functions have no ordinal number, but function names. What caused this difference?

Any help is greatly appreciated!

c++dllida


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source

Related Questions