4

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC.

HexRays often decompiles pseudocode like this, which, for example, deals with an MFC class CWinThread: IDA MFC code pseudocode

As you can see, the variable this is the CWinThread instance, but the layout of it seems undefined, it accesses its members through offsets.

I want / need to find out which members are at which offsets.

Even while easy to guess in the marked example (+48 seems to be the peeked message), there's another member slightly more below at offset +60 about which I have no clue. I searched the MSDN documentation and looked into the header file to find a layout of the class, but couldn't find anything that helped me.

Where would I retrieve such member / memory layout information about MFC classes?

Improve this question

3 Answers 3

Reset to default
1

You might have a look here, line number 456.

The method you are looking for seems to be the OnIdle function.

Remark: In 2018, the link is not active any more. However, the sources might be found in a Visual Studio Community edition (I am using VS2015), directory "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\atlmfc\src\mfc". The CWinThread class is contained in the file thrdcore.cpp.

Improve this answer
11
  • That's pretty amazing! Anyway, if I find another MFC class, how would I look this up?
    – Ray
    Apr 10, 2016 at 9:57
  • According to MS, the MFC full source code has been released by them. See msdn.microsoft.com/en-us/library/bs046sh0.aspx. Possibly only in the professional version of VStudio. Until some years ago, I had made many projects with MFC, and it was always possible to step into the MFC sources. However, I have not much reversing experience with them. The Ida decompiler seems to do a good job in the recognition of MFC.
    – josh
    Apr 10, 2016 at 10:52
  • The link seems dead, is it possible to get a new one?
    – Ray
    May 18, 2018 at 5:42
  • Here the link is still alive!
    – josh
    May 27, 2018 at 21:16
  • 1
    No problem, Ray. I searched a little and could not find the sources in the web. However, they are contained in VStudio. I edited the answer accordingly.
    – josh
    May 28, 2018 at 12:33
2

In order to easily import the information into IDA it's possible to:

  • Download Visual C++ and MFC (ideally the same version)

  • Make a very small C++ file which contains the definition of the type, for example:

    #include <afxwin.h>

    (you can verify that afxwin.h header indeed contains the definition of the class) Assume the file is saved as a.cpp

  • Compile it. (it's not necessary to link)

    cl /c /EHsc /Zi a.cpp

    The /Zi flag is important, it instructs the compiler to generate debug info.

    Along with a.obj, a vcXXX.pdb file should also be generated (can be vc80.pdb, vc100.pdb, vc140.pdb, etc. depends on the compiler version)

  • Enter IDA, open the project, choose File -> Load file -> PDB file..., then load that PDB file. Optionally enable Types only

The types should appear in the "Local Types" tab now.

Improve this answer
3
  • I tried this, but loading the vc40.pdb file (apparent version in this case) did not fill in any struct information. The Local Types window still only lists the names of the structs without their content. Output window states PDB: loaded 211 types though. Am I missing something?
    – Ray
    Nov 16, 2018 at 9:46
  • @RayKoopa Cannot reproduce. / Does any other struct definition get loaded?
    – user202729
    Nov 16, 2018 at 13:57
  • Nevermind, I was dumbly trying to load the PDB generated for a sample MFC app. I now loaded the PDB files provided with the MFC source. However, IDA only creates a vtable for the main class (like CObject) and not for child classes, like CWinApp. That makes it slightly useless...
    – Ray
    Dec 5, 2018 at 17:33
0

One way would be to get your hand on a copy of the compiler that was used to produce the binary, including the stock libraries that shipped with it - ideally the exact same version, or at least as close as possible.

Then you can simply compile suitable little test programs and load them into IDA for inspection and/or in order to export the type info and import it into the IDA database for your binary. Single struct defs can easily be transported via the clipboard (display as C struct, copy, switch to the other IDA, paste).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.