3

I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a signature for the particular MFC DLL version.

For example, if I load old MFCOGL.EXE 1.0.0.1 that uses MFC42.DLL 6.06.8064.0, IDA shows all MFC DLL entries as MFC_nnnn, where nnnn is an ordinal number of the export. Even if I place MFC42.DLL together with the corresponding MFC42.PDB (downloaded from MS Symbol Store) to the same directory, IDA doesn't load PDB for the DLL, just applying the common signature:

File C:\Tmp\4\mfc42.dll is used for module MFC42...
Plugin "eh_parse" not found
Plan FLIRT signature: Microsoft VisualC 2-14/net runtime
autoload.cfg: vc32rtf.sig autoloads mssdk_win7.til
Type library 'mssdk_win7' loaded. Applying types...
Types applied to 87 names.
Plan FLIRT signature: MFC 3.1-14.0 32bit
autoload.cfg: vc32mfc.sig autoloads mssdk_win7.til

If I try to load the PDB explicitly, IDA applies it to the main EXE, not to the DLL referenced by the EXE.

If I load the DLL as an additional binary file, IDA doesn't treat it as a PE module.

Ghidra successfully finds and loads all MFC symbols, but IDA is more familiar to me.

Is there a way to instruct IDA to load the PDB?

Improve this question
2
  • for clarification, how are you building it? all instances of it (MFCOGL.EXE) that i could find were zip2exe. nonetheless, i have an mfc42.dll at version '6.06.8063.0' and some random MFC-linked executable i found (markplot.exe) that links with it by ordinal.. and it seems to load fine in both IDA 7.1, and 8.2. however, executables don't link to dlls by version (unless SxS is used) and symbol files get applied to binaries (not imports). so i think what you're asking is how to copy information from the exports of one database into the imports of another when the disassembler doesn't do it?
    – Ali Rizvi-Santiago
    May 18 at 17:26
  • I never built it. I took MFCOGL.EXE (1.0.0.1 from 1995) from MS examples many years ago, and just found it in my archive, looking for various MFC applications to test with IDA and Ghidra. I was told that IDA and Ghidra never use PDBs for DLL imports. Only standard databases (IDA Free doesn't have all of them) are used. This is very surprisingly and strange for me, but it's true. I successfully built an IDT file for the required MFC DLLs, now IDA shows the imports.
    – Eugene Muzychenko
    May 19 at 14:32

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.