I'm trying with ghidra to reverse a 32-bit proprietary application that uses
mfc42.dll and I'm obtaining mixed results with respect to imported functions.
To my surprise the
DLLs don't use names to export functions like the
ELF format, but use the so called ordinals and you need another file (the corresponding
.lib) to link them with the actual name.
In the binary there is a particular function that seems to call ordinal 4129 and ordinal 5710 corresponding to
CString::Right(int) respectively (ghidra internally uses an XML to track the correspondence function <-> ordinal).
But if I check the actual assembly of this function seems that these functions take a further argument (this can be deduced from the stack depth value that you can enable along the disassembly with ghidra). Obviously I'm taking into account the fact that the class instance is passed via the
ecx register but that it's not relevant for the discussion, I'm interested in the arguments passed using the stack.
Trying to reverse the dll itself, indeed ghidra finds out the signature as having two arguments but bad enough it cannot tell what is the actual name of these functions.
mfc42.dll (I think) is a pretty standard library can anyone explain to me what is going on?
To add information, the application seems compiled using Visual Studio VC6, this can be deduced from the signature of the
FuncInfo structure that is
CString::Leftactually takes 2 arguments of type
CString, one as the source, one as the destination.