0

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718.

What are those functions ? what they do ?

thanks

  • You can find the dll in System32 folder. – Biswapriyo Nov 7 at 17:37
  • @Biswapriyo I know, but I looking for documentation what the function mfc140_6153 or mfc140_8718 do please – joif doi Nov 10 at 8:15
  • Obviously, those are undocumented. The numbers 6153 and 8718 looks like ordinal numbers. When there is no name for the exported function programs tends to use ordinal numbers. – Biswapriyo Nov 10 at 8:38
0

These are functions exported by ordinal rather than by name.

This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library.

6153 
?GetRecentListOfPanes@CRecentDockSiteInfo@@QEAAAEAV?$CList@PEAUHWND__@@PEAU1@@@H@Z
public: class CList<struct HWND__ * __ptr64,struct HWND__ * __ptr64> & __ptr64 __cdecl CRecentDockSiteInfo::GetRecentListOfPanes(int) __ptr64

8718 
?OnCancelMode@CPane@@IEAAXXZ
protected: void __cdecl CPane::OnCancelMode(void) __ptr64

You can find lists of these in several reverse engineering tools. e.g. Ghidra

  • , thanks, is that dll depend at windows version? or in all mfc dll function 8718 is OnCancelMode ? – joif doi Nov 17 at 7:29
  • One downside of exporting by ordinal is that the ordinal numbers cannot change if there are any updates to the DLL. Otherwise applications linked against one version will fail if run against a different version. The MFC DLLs do not depend on windows version. They do depend on the version of MFC that app uses though. See en.wikipedia.org/wiki/… – Ian Cook Nov 17 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.