While I open exe file in ida I can see lot of calls to mfc140_6153
or mfc140_8718.
What are those functions ? what they do ?
thanks
1 Answer
These are functions exported by ordinal rather than by name.
This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library.
6153
?GetRecentListOfPanes@CRecentDockSiteInfo@@QEAAAEAV?$CList@PEAUHWND__@@PEAU1@@@H@Z
public: class CList<struct HWND__ * __ptr64,struct HWND__ * __ptr64> & __ptr64 __cdecl CRecentDockSiteInfo::GetRecentListOfPanes(int) __ptr64
8718
?OnCancelMode@CPane@@IEAAXXZ
protected: void __cdecl CPane::OnCancelMode(void) __ptr64
You can find lists of these in several reverse engineering tools. e.g. Ghidra
-
, thanks, is that dll depend at windows version? or in all mfc dll function
8718is OnCancelMode ?– joif doiNov 17, 2019 at 7:29 -
One downside of exporting by ordinal is that the ordinal numbers cannot change if there are any updates to the DLL. Otherwise applications linked against one version will fail if run against a different version. The MFC DLLs do not depend on windows version. They do depend on the version of MFC that app uses though. See en.wikipedia.org/wiki/…– Ian CookNov 17, 2019 at 21:49
mfc140_6153ormfc140_8718do please6153and8718looks like ordinal numbers. When there is no name for the exported function programs tends to use ordinal numbers.