Trying to decompile a MFC snippet code [Archive] - RCE Messageboard's Regroupment

View Full Version : Trying to decompile a MFC snippet code

dion

January 21st, 2013, 18:11

Hi,

i've been trying to figured out what kind of code that can produce similar output such as :

Code:

.text:004070A2                 mov     ecx, offset CWnd1

.text:004070A7                 mov     [esi+70h], eax

.text:004070AA                 call    ?GetMainWnd@CWinThread@@UAEPAVCWnd@@XZ ; CWinThread::GetMainWnd(void)

.text:004070AF                 xor     ebx, ebx

.text:004070B1                 cmp     eax, ebx

.text:004070B3                 jnz     short loc_4070B9

.text:004070B5                 xor     eax, eax

.text:004070B7                 jmp     short loc_4070BC

.text:004070B9 ; ---------------------------------------------------------------------------

.text:004070B9

.text:004070B9 loc_4070B9:                             ; CODE XREF: gamestart-2BDj

.text:004070B9                 mov     eax, [eax+1Ch]

.text:004070BC

.text:004070BC loc_4070BC:                             ; CODE XREF: gamestart-2B9j

.text:004070BC                 mov     ecx, [esi+40h]

.text:004070BF                 push    offset off_4E6A98

.text:004070C4                 push    ecx

.text:004070C5                 push    eax

.text:004070C6                 call    dword ptr [esi+70h] ; GameInit()

i tried to figure out the parameters of GameInit(). by trial and error, i got the following code (which a little bit match) :

Code:



CWinThread* pThread = AfxGetThread();

CWnd* m_pMainWnd = pThread->GetMainWnd();

HWND test = m_pMainWnd->m_hWnd;

but it's not right. the disassemble form of the above code is :

Code:



102:      CWinThread* pThread = AfxGetThread();

004012FD   call        AfxGetThread (00401854)

00401302   mov         dword ptr [ebp-8],eax

103:

104:      CWnd* m_pMainWnd = pThread->GetMainWnd();

00401305   mov         eax,dword ptr [ebp-8]

00401308   mov         edx,dword ptr [eax]

0040130A   mov         esi,esp

0040130C   mov         ecx,dword ptr [ebp-8]

0040130F   call        dword ptr [edx+7Ch]

00401312   cmp         esi,esp

00401314   call        _chkesp (0040191a)

00401319   mov         dword ptr [ebp-0Ch],eax

105:

106:      HWND test = m_pMainWnd->m_hWnd;

0040131C   mov         eax,dword ptr [ebp-0Ch]

0040131F   mov         ecx,dword ptr [eax+20h]  ;<<<<<<<< see this

00401322   mov         dword ptr [ebp-10h],ecx

so for 1st param, i got a near match, eax+20h instead of eax+1Ch. i looked into CWnd structure, it's wierd. it's said m_hWnd is first data member. looking from the number, it should have previous data member. but it seems i can not find them in the list (i.e. type "m_pMainWnd->" then see the list in MSVC IDE and compile and see the code). anyone can help or give a hint?

thanks

bilbo

January 22nd, 2013, 10:45

Try this simple program (assuming it is called try.cpp)

Code:



// compile from VS Command Prompt as cl -MT try.cpp



#include <afxwin.h>



void

main(void)

{

    printf("%x\n", offsetof(CWnd, m_hWnd));

}

In VS2010 (MFC 10.0) the output is 20, as you found out;
but in VS6 (MFC 4.2) the output is 1C!

Best regards, bilbo

dion

January 22nd, 2013, 11:06

Quote:

[Originally Posted by bilbo;94080]Try this simple program (assuming it is called try.cpp)

Code:

// compile from VS Command Prompt as cl -MT try.cpp

#include <afxwin.h>

void
main(void)
{
printf("%x\n", offsetof(CWnd, m_hWnd));
}

In VS2010 (MFC 10.0) the output is 20, as you found out;
but in VS6 (MFC 4.2) the output is 1C!

Best regards, bilbo

thanks for the insight bilbo

but actually, i code in msvc6 sp5 ent edition. not in vs2010. i checked my output program DLL dependency, it is MFC42D.DLL. so what i did wrong?

bilbo

January 23rd, 2013, 07:53

I see...
You are compiling using MFC as a dynamic library, while they are using MFC as a static library.
Compile the program above as

Code:

cl -W3 -MD -D_AFXDLL try.cpp

and you will obtain 0x20, no more 0x1C.
The difference is in the member

Code:

static const AFX_MSGMAP* PASCAL _GetBaseMessageMap();

(see AFXWIN.H)

Best regards, bilbo