[Upgrading, Modifying and Unlocking] vagus_ppcw:
Microsoft Portable Executable and Common Object File Format Specification

download from http://msdn.microsoft.com/msdnmag/issues/02/03/Loader/default.aspx

go to page 49, read 6.4.3 Hint/Name Table, and 6.4.2 Import Lookup Table

here is tiacxwln.dll in hexedit

000432C0 6C00 0800 575A 4353 6574 436F 6E74 6578 l...WZCSetContex
000432D0 7400 0500 575A 4351 7565 7279 436F 6E74 t...WZCQueryCont
000432E0 6578 7400 777A 6373 6170 692E 646C 6C00 ext.wzcsapi.dll.
000432F0 0000 0000 A02D 7DD3 0000 0000 2C3F 0400 .....-}.....,?..
00043300 0100 0000 0200 0000 0200 0000 183F 0400 .............?..
00043310 203F 0400 283F 0400 0CB4 0000 E0BB 0000 ?..(?..........
00043320 483F 0400 393F 0400 0100 0000 7469 6163 H?..9?......tiac
00043330 7877 6C6E 2E64 6C6C 0049 6E73 7461 6C6C xwln.dll.Install
00043340 5F44 7269 7665 7200 4472 6976 6572 456E _Driver.DriverEn
00043350 7472 7900 0000 0000 0000 0000 0000 0000 try.............
00043360 0000 0000 0000 0000 0000 0000 0000 0000 ................
00043370 0000 0000 0000 0000 0000 0000 0000 0000 ................
00043380 0000 0000 0000 0000 0000 0000 0000 0000 ................
00043390 0000 0000 0000 0000 0000 0000 0000 0000 ................
000433A0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000433B0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000433C0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000433D0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000433E0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000433F0 0000 0000 0000 0000 0000 0000 0000 0000 ................
00043400 1500 0080 0000 0000 C701 0080 D001 0080 ................
00043410 C801 0080 3F00 0080 C901 0080 3A00 0080 ....?.......:...
00043420 3D00 0080 CF01 0080 CD01 0080 1404 0080 =...............
00043430 1102 0080 1202 0080 1002 0080 1E00 0080 ................
00043440 F001 0080 2902 0080 EC01 0080 2102 0080 ....).......!...
00043450 1704 0080 2502 0080 2402 0080 AC00 0080 ....%...$.......
00043460 0402 0080 8F04 0080 2602 0080 EE01 0080 ........&.......
00043470 EF01 0080 F101 0080 0600 0080 F201 0080 ................
00043480 D507 0080 2C04 0080 A800 0080 7402 0080 ....,.......t...
00043490 2D06 0080 2D02 0080 2904 0080 0400 0080 -...-...).......
000434A0 0500 0080 D807 0080 5307 0080 2400 0080 ........S...$...
000434B0 5407 0080 0C00 0080 1702 0080 1604 0080 T...............
000434C0 0000 0000 943D 0400 A83D 0400 C03D 0400 .....=...=...=..
000434D0 D43D 0400 EA3D 0400 003E 0400 163E 0400 .=...=...>...>..
000434E0 2E3E 0400 4E3E 0400 663E 0400 803E 0400 .>..N>..f>...>..
000434F0 9C3E 0400 6C3D 0400 583D 0400 403D 0400 .>..l=..X=..@=..
00043500 283D 0400 0E3D 0400 F63C 0400 DA3C 0400 (=...=...<...<..
00043510 C23C 0400 A83C 0400 903C 0400 7E3C 0400 .<...<...<..~<..
00043520 443C 0400 7C3D 0400 643C 0400 0000 0000 D<..|=..d<......
00043530 1401 0080 1101 0080 0000 0000 D23E 0400 .............>..
00043540 C23E 0400 0000 0000 0000 0000 3C6B 0110 .>..........<k..
00043550 0000 0000 0000 0000 0000 0000 0000 0000 ................

432c2 and 432d2 are members of Hint/Name Table

first two bytes (i suppose previously ordinal) is explained as: An index into the export name pointer table. A match is attempted first with this value. If it fails, a binary search is performed on the DLL’s export name pointer table.

another description:

4353c and 43540 are two members of Import Lookup Table and contains: 00403ed2 and 00403ec2

since bit 31 is not set (they are not 80000005 and 80000008), they are : 31-bit RVA of a hint/name table entry.

How could we see RVA?

load this dll with ida pro and look at address 43ec2 and 43ed2 (actually they are 432c2 and 432d2 in hexeditor):

.text:10043EC2 DCB 8
.text:10043EC3 DCB 0
.text:10043EC4 aWzcsetcontext DCB "WZCSetContext",0
.text:10043ED2 DCB 5
.text:10043ED3 DCB 0
.text:10043ED4 aWzcquerycontex DCB "WZCQueryContext",0
.text:10043EE4 aWzcsapi_dll DCB "wzcsapi.dll",0
.text:10043EF0 DCB 0
.text:10043EF1 DCB 0
.text:10043EF2 DCB 0
.text:10043EF3 DCB 0

So, ordinals (actually hints) is not correct, but import lookup table doesn't contains ordinals (bit 31 is not set) instead it contains RVA (pointer to function names). So Portable Executable (PE) loader try to find functions at ordinals 05 and 08, but find that function names are incorrect, then it will do a binary search to find to correct ordinals, eventually find the 06 and 0c.

if you look at hexedit at 43408, you will see the numbers: 800001c7, 800001d0, etc. This means, coredll.dll function addresses are imported by ordinals(bit 31 is set, starts with 80), not by pointers to names. ordinal 01c7 corresponds to RegCloseKey, and ordinal 01d0 corresponts to RegSetValueExW.

then comes ndis.dll functions, at 434c4 (look at hexedit window) they are pointers to function names : 00043d94, 00043da8, etc..