Getting the required APIs from Kernel32.dll

For the shellcode to be able to access the kernel32.dll's APIs, it should parse its export table. The export table consists of three arrays. The first array is AddressOfNames, which contains the names of the APIs inside the DLL file. The second array is AddressOfFunctions, which contains the relative addresses (RVAs) of all of these APIs:

Figure 6: Export table structure (the numbers here are not real and have been provided as an example)

However, the issue here in these two arrays is that they are aligned with a different alignment. For example, GetProcAddress could be in the third item in the AddressOfNames, but it's in the fifth item in the AddressOfFunctions.

To handle this issue, Windows created a third array named AddressOfNameOrdinals. This array has the same alignment as AddressOfNames and contains the index of every item in the AddressOfFunctions. Note that AddressOfFunctions and AddressOfNameOrdinals have more items than...