0

I am trying to reverse engineer an application. I don't understand is this MFC framework.

enter image description here

Should i learn MFC to understand the following code. or is it Win32 code developing. But how Win32 works with resource and it's content. Like if i want to have an dialog i have to create an dialog in resource section. This is what we learn when we learn MFC framework. But looking at the snap shoot what source code is it ? is it raw source code if so then you how Win32 resource work together. Can you give me the guide line what framework and programming tactic used in following disassembly (snap shoot).

ps: Guide suggestion appreciated.

Improve this question
2
  • 1
    Yes, you should learn about MFC if you would like to reverse engineer MFC applications. Voting to close as off topic because OP clearly did not spend the time to investigate the material he's asking about.
    – NirIzr
    Jun 5, 2018 at 19:16
  • 1
    Frankly, both will be necessary and helpful in the long run. If you deal with the Win32 subsystem, knowing about the Win32 API is an excellent preparation for reverse engineering WTL or MFC based applications. Knowing about those frameworks in turn will help you identify patterns and leave the unimportant stuff alone. NB: if I understand you correctly you are trying to gauge if the program uses MFC or pure Win32 based purely on the static imports. That's not possible. You might want to amend your question to include actual bits of disassembly.
    – 0xC0000022L ♦
    Jun 5, 2018 at 20:59

1 Answer 1

Reset to default
3

By this screenshot it's not really clear if it's MFC or not, due to MFC can be linked statically. And when MFC is linked statically you won't see any MFC function name in the imports window. Nevertheless, if IDA detects static MFC library it tries to apply MFC signatures msmfc*.sig So you should check the signatures window in IDA too and see if it found anything. Also you may try to apply MFC signatures manually, because IDA might failed to detect it. If applying the signature gave you 200 or more library functions detected, then yes, there's MFC code in the app.

p.s. all the UI frameworks have to use API from user32.dll and gdi32.dll in order to work in Windows. So you'll find the those imports, no matter the UI framework, that was used in the app.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.