I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions.
To my surprise the DLLs don't use names to export functions like the ELF format, but use the so called ordinals and you need another file (the corresponding .lib) to link them with the actual name.
In the binary there is a particular function that seems to call ordinal 4129 and ordinal 5710 corresponding to CString::Left(int) and CString::Right(int) respectively (ghidra internally uses an XML to track the correspondence function <-> ordinal).
But if I check the actual assembly of this function seems that these functions take a further argument (this can be deduced from the stack depth value that you can enable along the disassembly with ghidra). Obviously I'm taking into account the fact that the class instance is passed via the ecx register but that it's not relevant for the discussion, I'm interested in the arguments passed using the stack.
Trying to reverse the dll itself, indeed ghidra finds out the signature as having two arguments but bad enough it cannot tell what is the actual name of these functions.
Since mfc42.dll (I think) is a pretty standard library can anyone explain to me what is going on?
To add information, the application seems compiled using Visual Studio VC6, this can be deduced from the signature of the FuncInfo structure that is 0x19930520.
CString::Leftactually takes 2 arguments of typeCString, one as the source, one as the destination.