2

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC.

HexRays often decompiles pseudocode like this, which, for example, deals with an MFC class CWinThread: IDA MFC code pseudocode

As you can see, the variable this is the CWinThread instance, but the layout of it seems undefined, it accesses its members through offsets.

I want / need to find out which members are at which offsets.

Even while easy to guess in the marked example (+48 seems to be the peeked message), there's another member slightly more below at offset +60 about which I have no clue. I searched the MSDN documentation and looked into the header file to find a layout of the class, but couldn't find anything that helped me.

Where would I retrieve such member / memory layout information about MFC classes?

1

You might have a look here, line# 456ff.

The method you are looking for seems to be the OnIdle function.

Remark: In 2018, the link is not active any more. However, the sources might be found in a Visual Studio Community edition (I am using VS2015), directory "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\atlmfc\src\mfc". The CWinThread class is contained in the file thrdcore.cpp.

  • That's pretty amazing! Anyway, if I find another MFC class, how would I look this up? – Ray Koopa Apr 10 '16 at 9:57
  • According to MS, the MFC full source code has been released by them. See msdn.microsoft.com/en-us/library/bs046sh0.aspx. Possibly only in the professional version of VStudio. Until some years ago, I had made many projects with MFC, and it was always possible to step into the MFC sources. However, I have not much reversing experience with them. The Ida decompiler seems to do a good job in the recognition of MFC. – josh Apr 10 '16 at 10:52
  • The link seems dead, is it possible to get a new one? – Ray Koopa May 18 '18 at 5:42
  • Here the link is still alive! – josh May 27 '18 at 21:16
  • 1
    No problem, Ray. I searched a little and could not find the sources in the web. However, they are contained in VStudio. I edited the answer accordingly. – josh May 28 '18 at 12:33
2

In order to easily import the information into IDA it's possible to:

  • Download Visual C++ and MFC (ideally the same version)
  • Make a very small C++ file which contains the definition of the type, for example:

    #include <afxwin.h>
    

    (you can verify that afxwin.h header indeed contains the definition of the class) Assume the file is saved as a.cpp

  • Compile it. (it's not necessary to link)

    cl /c /EHsc /Zi a.cpp
    

    The /Zi flag is important, it instructs the compiler to generate debug info.

    Along with a.obj, a vcXXX.pdb file should also be generated (can be vc80.pdb, vc100.pdb, vc140.pdb, etc. depends on the compiler version)

  • Enter IDA, open the project, choose File -> Load file -> PDB file..., then load that PDB file. Optionally enable Types only

The types should appear in the "Local Types" tab now.

  • I tried this, but loading the vc40.pdb file (apparent version in this case) did not fill in any struct information. The Local Types window still only lists the names of the structs without their content. Output window states PDB: loaded 211 types though. Am I missing something? – Ray Koopa Nov 16 '18 at 9:46
  • @RayKoopa Cannot reproduce. / Does any other struct definition get loaded? – user202729 Nov 16 '18 at 13:57
  • Nevermind, I was dumbly trying to load the PDB generated for a sample MFC app. I now loaded the PDB files provided with the MFC source. However, IDA only creates a vtable for the main class (like CObject) and not for child classes, like CWinApp. That makes it slightly useless... – Ray Koopa Dec 5 '18 at 17:33
0

One way would be to get your hand on a copy of the compiler that was used to produce the binary, including the stock libraries that shipped with it - ideally the exact same version, or at least as close as possible.

Then you can simply compile suitable little test programs and load them into IDA for inspection and/or in order to export the type info and import it into the IDA database for your binary. Single struct defs can easily be transported via the clipboard (display as C struct, copy, switch to the other IDA, paste).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.