Silver
August 14th, 2005, 08:13
Hi guys,
Following my other post about getting the right pdb/dll combo to make an NMS for MFC, I got a bit frustrated with looking at ordinals. So I wrote this little app that scans through a WDASM deadlist - .alf file - and rewrites all the "Ordinal" text to proper MFC class/function names. I know IDA can do similar and there are alternatives, but I wrote it to solve my own problem. Maybe it'll help someone else.
This:
becomes:
There are still a few bugs in it, and it doesn't always correctly decorate the class::function names (mainly because there are some unnamed functions and the def formatting isn't 100% uniform). But it's good enough to make the deadlist readable and immediately understandable as to what's happening.
If you're working with an MFC app then this prog and this url might help:
http://msdn.microsoft.com/library/en-us/vclib/html/vclrfMFCClassListing.asp
Bug reports appreciated but will probably be ignored
Following my other post about getting the right pdb/dll combo to make an NMS for MFC, I got a bit frustrated with looking at ordinals. So I wrote this little app that scans through a WDASM deadlist - .alf file - and rewrites all the "Ordinal" text to proper MFC class/function names. I know IDA can do similar and there are alternatives, but I wrote it to solve my own problem. Maybe it'll help someone else.
This:
Code:
:004022D4 8D8EC4030000 lea ecx, dword ptr [esi+000003C4]
* Reference To: MFC42.Ordinal:1837, Ord:1837h
|
:004022DA E8C73B0000 Call 00405EA6
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004022CD(C)
|
:004022DF 6A00 push 00000000
:004022E1 8D8E84020000 lea ecx, dword ptr [esi+00000284]
* Reference To: MFC42.Ordinal:0A52, Ord:0A52h
|
:004022E7 E8B43B0000 Call 00405EA0
becomes:
Code:
:004022D4 8D8EC4030000 lea ecx, dword ptr [esi+000003C4]
* Reference To: MFC - CWnd::SetWindowTextA() (Ordinal: 6199)
|
:004022DA E8C73B0000 Call 00405EA6
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004022CD(C)
|
:004022DF 6A00 push 00000000
:004022E1 8D8E84020000 lea ecx, dword ptr [esi+00000284]
* Reference To: MFC - CWnd::EnableWindow() (Ordinal: 2642)
|
:004022E7 E8B43B0000 Call 00405EA0
There are still a few bugs in it, and it doesn't always correctly decorate the class::function names (mainly because there are some unnamed functions and the def formatting isn't 100% uniform). But it's good enough to make the deadlist readable and immediately understandable as to what's happening.
If you're working with an MFC app then this prog and this url might help:
http://msdn.microsoft.com/library/en-us/vclib/html/vclrfMFCClassListing.asp
Bug reports appreciated but will probably be ignored
