4

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC.

HexRays often decompiles pseudocode like this, which, for example, deals with an MFC class CWinThread: IDA MFC code pseudocode

As you can see, the variable this is the CWinThread instance, but the layout of it seems undefined, it accesses its members through offsets.

I want / need to find out which members are at which offsets.

Even while easy to guess in the marked example (+48 seems to be the peeked message), there's another member slightly more below at offset +60 about which I have no clue. I searched the MSDN documentation and looked into the header file to find a layout of the class, but couldn't find anything that helped me.

Where would I retrieve such member / memory layout information about MFC classes?

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
Ray
  • 1,083
  • 9
  • 25

3 Answers3

2

In order to easily import the information into IDA it's possible to:

  • Download Visual C++ and MFC (ideally the same version)

  • Make a very small C++ file which contains the definition of the type, for example:

    #include <afxwin.h>

    (you can verify that afxwin.h header indeed contains the definition of the class) Assume the file is saved as a.cpp

  • Compile it. (it's not necessary to link)

    cl /c /EHsc /Zi a.cpp

    The /Zi flag is important, it instructs the compiler to generate debug info.

    Along with a.obj, a vcXXX.pdb file should also be generated (can be vc80.pdb, vc100.pdb, vc140.pdb, etc. depends on the compiler version)

  • Enter IDA, open the project, choose File -> Load file -> PDB file..., then load that PDB file. Optionally enable Types only

The types should appear in the "Local Types" tab now.

user202729
  • 675
  • 1
  • 4
  • 14
  • I tried this, but loading the vc40.pdb file (apparent version in this case) did not fill in any struct information. The Local Types window still only lists the names of the structs without their content. Output window states PDB: loaded 211 types though. Am I missing something? – Ray Nov 16 '18 at 09:46
  • @RayKoopa Cannot reproduce. / Does any other struct definition get loaded? – user202729 Nov 16 '18 at 13:57
  • Nevermind, I was dumbly trying to load the PDB generated for a sample MFC app. I now loaded the PDB files provided with the MFC source. However, IDA only creates a vtable for the main class (like CObject) and not for child classes, like CWinApp. That makes it slightly useless... – Ray Dec 05 '18 at 17:33
1

You might have a look here, line number 456.

The method you are looking for seems to be the OnIdle function.

Remark: In 2018, the link is not active any more. However, the sources might be found in a Visual Studio Community edition (I am using VS2015), directory "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\atlmfc\src\mfc". The CWinThread class is contained in the file thrdcore.cpp.

Community
  • 1
josh
  • 1,974
  • 12
  • 9
  • That's pretty amazing! Anyway, if I find another MFC class, how would I look this up? – Ray Apr 10 '16 at 09:57
  • According to MS, the MFC full source code has been released by them. See https://msdn.microsoft.com/en-us/library/bs046sh0.aspx. Possibly only in the professional version of VStudio. Until some years ago, I had made many projects with MFC, and it was always possible to step into the MFC sources. However, I have not much reversing experience with them. The Ida decompiler seems to do a good job in the recognition of MFC. – josh Apr 10 '16 at 10:52
  • The link seems dead, is it possible to get a new one? – Ray May 18 '18 at 05:42
  • Here the link is still alive! – josh May 27 '18 at 21:16
  • It's about the link in the question (not your comment :D), it claims "File not found" for me. – Ray May 28 '18 at 06:09
  • In case you mean the link to CWinThread in the question, it's still intact here. – josh May 28 '18 at 11:45
  • Very weird. To me it just replies "Sorry, the requested URL path "/windows/misc/winscp577source.zip" was not found on this server." – Ray May 28 '18 at 11:46
  • Strange... The link is:https://msdn.microsoft.com/en-us/library/48xz4yz9.aspx – josh May 28 '18 at 11:48
  • Ok, now I found the link you are talking about! It is the link of my answer, not the question. This indeed seems to be broken. I'll have a look... Sorry for the confusion. – josh May 28 '18 at 11:51
  • Thanks, sorry for confusing you about "Question" / "Answer", it's too hot today... :o) – Ray May 28 '18 at 12:02
  • 1
    No problem, Ray. I searched a little and could not find the sources in the web. However, they are contained in VStudio. I edited the answer accordingly. – josh May 28 '18 at 12:33
0

One way would be to get your hand on a copy of the compiler that was used to produce the binary, including the stock libraries that shipped with it - ideally the exact same version, or at least as close as possible.

Then you can simply compile suitable little test programs and load them into IDA for inspection and/or in order to export the type info and import it into the IDA database for your binary. Single struct defs can easily be transported via the clipboard (display as C struct, copy, switch to the other IDA, paste).

DarthGizka
  • 2,010
  • 1
  • 13
  • 30