PDA

View Full Version : mfc70 export functions names in Olly?

theMyth
September 11th, 2006, 02:12
Hi, i am new to Olly (new to reversing too). After loading an app into Olly, i saw these lines:

Code:


004BAFAC   $- FF25 A42D4C00 JMP DWORD PTR DS:[<&MFC70.#664>]         ;  MFC70.#664

004BAFB2   $- FF25 A02D4C00 JMP DWORD PTR DS:[<&MFC70.#859>]         ;  MFC70.#859

004BAFB8   $- FF25 9C2D4C00 JMP DWORD PTR DS:[<&MFC70.#892>]         ;  MFC70.#890

004BAFBE   $- FF25 982D4C00 JMP DWORD PTR DS:[<&MFC70.#893>]         ;  MFC70.#893

004BAFC4   .- FF25 942D4C00 JMP DWORD PTR DS:[<&MFC70.#3103>]        ;  MFC70.#3359

004BAFCA   $- FF25 902D4C00 JMP DWORD PTR DS:[<&MFC70.#477>]         ;  MFC70.#477

004BAFD0   $- FF25 8C2D4C00 JMP DWORD PTR DS:[<&MFC70.#705>]         ;  MFC70.#257

004BAFD6   $- FF25 882D4C00 JMP DWORD PTR DS:[<&MFC70.#5201>]        ;  MFC70.#5201

004BAFDC   $- FF25 842D4C00 JMP DWORD PTR DS:[<&MFC70.#3676>]        ;  MFC70.#3675

004BAFE2   $- FF25 802D4C00 JMP DWORD PTR DS:[<&MFC70.#703>]         ;  MFC70.#703

004BAFE8   $- FF25 7C2D4C00 JMP DWORD PTR DS:[<&MFC70.#5209>]        ;  MFC70.#5209

004BAFEE   $- FF25 782D4C00 JMP DWORD PTR DS:[<&MFC70.#2129>]        ;  MFC70.#2128

004BAFF4   .- FF25 742D4C00 JMP DWORD PTR DS:[<&MFC70.#3018>]        ;  MFC70.#3018

004BAFFA   $- FF25 702D4C00 JMP DWORD PTR DS:[<&MFC70.#1784>]        ;  MFC70.#1784

004BB000   .- FF25 6C2D4C00 JMP DWORD PTR DS:[<&MFC70.#3012>]        ;  MFC70.#3012

004BB006   $- FF25 682D4C00 JMP DWORD PTR DS:[<&MFC70.#957>]         ;  MFC70.#957

004BB00C   $- FF25 642D4C00 JMP DWORD PTR DS:[<&MFC70.#982>]         ;  MFC70.#982

004BB012   $- FF25 602D4C00 JMP DWORD PTR DS:[<&MFC70.#256>]         ;  MFC70.#256

004BB018   $- FF25 5C2D4C00 JMP DWORD PTR DS:[<&MFC70.#1306>]        ;  MFC70.#1306

004BB01E   $- FF25 582D4C00 JMP DWORD PTR DS:[<&MFC70.#6002>]        ;  MFC70.#6002

004BB024   $- FF25 542D4C00 JMP DWORD PTR DS:[<&MFC70.#5095>]        ;  MFC70.#5095

004BB02A   $- FF25 502D4C00 JMP DWORD PTR DS:[<&MFC70.#2714>]        ;  MFC70.#2714

004BB030   $- FF25 4C2D4C00 JMP DWORD PTR DS:[<&MFC70.#5381>]        ;  MFC70.#5381


Is it able to make Olly recognize and assign a meaningful name for these functions.

Thanks in advance.
blabberer
September 11th, 2006, 02:34
hi i believe there are posts on converting mfc ordinals to its import names
in this forum i might be wrong havent searched my self but i believe i answered similar questions earlier give the search function a spin

anyway to answer you

mfc applications always import thier functions by ordinals (there are over 7000functions iirc and its a space saving method to import by ordinal )

if you want to rename them to your original names you would need the pdb
or if you have mfc installed you can search for the lib and
use ollydbgs implib scanner


or if you have idafree analyse the appliction along with pdb for mfc
and create a map from ida and load the map to ollydbg
with one of the plugins like (godup,mapconvertor)
iirc with godup plugin you can directly apply the flirt signatures of ida
to ollydbg

if i find some thing later thats relevent ill edit this post
theMyth
September 11th, 2006, 03:24
Thank you for your very quick help ,

Quote:
"if you have mfc installed you can search for the lib and use ollydbgs implib scanner "


I put 2 file 'mfc42.lib and mfc71.lib' to lib folder and edit ollydbg.ini to use them but no luck, still the ordinal names

Quote:

"or if you have idafree analyse the appliction along with pdb for mfc
and create a map from ida and load the map to ollydbg
with one of the plugins like (godup,mapconvertor)
iirc with godup plugin you can directly apply the flirt signatures of ida
to ollydbg "


I used IDA to analyze it but it show this error:
http://img242.imageshack.us/img242/4485/idaerrloadso4.jpg

and after finishing the analysis, in names windows :
http://img227.imageshack.us/img227/2218/error2wp2.jpg

I haven't got the pdb file, so i will search for it right now.

Regards.
LLXX
September 12th, 2006, 20:57
The MFC70 functions all are ordinal-only, you might have to trace into them to see what they do.

It seems you can obtain MFC70.PDB by downloading the VS SP1, but retrieving 80+Mb of files only for a 10Mb one is a bit discouraging...
Nacho_dj
September 13th, 2006, 16:40
There was a similar thread in another forum, maybe it could add some more information to the issue:
http://community.reverse-engineering.net/viewtopic.php?t=5342&highlight=mfc71

Cheers

Nacho_dj
naides
September 30th, 2006, 08:53
A little late answer but I finally got around to do it:

To get the mfc71.pdb (or ANY M$ module):

Use Symbol retriever app from SoftIce:

open Symbol retriever, click add,
navigate to %sysroot%/system32/mfc71.dll

CORRECT address of the server is http://msdn.microsoft.com/download/symbols
(in fress installation there is a wrong address placed there by default)

get symbols

mfc71.pdb is downloaded to your local PDB storage folder (By default /symserver)

Take it from there
blabberer
September 30th, 2006, 09:53
oops getting mfc pdb was the problem ?
it seems i missed that sentence when i read it first time

apart from softice symbol retriever you can get pdbs directly from ms symbol servers from inside of ollydbg

or there are a few specific utilities just deveoted to these purposes
notable among them being oleg starodumov's debuginfo.com

to make ollydbg fetch symbols from ms symbol server
check this thread here in this forum

http://www.woodmann.com/forum/showthread.php?t=8460&highlight=symbol+server

you should get the latest redistributable of dbghlp.dll and symsrv.dll from ms


or check this out
http://debuginfo.com/tools/symget.html
it comes with those latest redistributables and you can get any pdb specifically with this utility

explore the root of the link it contains some really valuble information regarding working with symbols

btw as far as ida is concerned you need to give ida (i am talking about freeware version ) the latest dbghlp.dll and probably symsrv.dll as well for it to access find and display all the information the load pdb plugin that comes along chokes on rsds signatures (pdb 7.0) format thats the default pdb for xp and > it works well on w2k pdbs which had NB10 (pdb 2.0) signatures


or simply get windbg latest edition (cute and great functionality and really worth to spend time on it it looks like well of death till you dive into it but once you have dived and started swimming youll really like it ) set _NT_SYMBOL_PATH variable and just forget it it will fetch whatever symbol
you need automatically all you have to do is leech from symbol cache for your specific purposes

or you can even wget the pdbs provided you can understand the sendv query
theMyth
September 30th, 2006, 17:53
Thank you very much, symget works great
Knight
October 4th, 2006, 01:39
As about IDA, if functions are imported by ordinals to get their names you can apply corresponding *.ids file (if you got one).

Regards,
Knight