Understanding MFC DLLs

Asked 1 years ago, Updated 1 years ago, 130 views

When I reversely assemble it in the assembler, I see a line like CALL MFC42.#800. Is there any way to find out what kind of DLL this is from this number?
Or related sites, etc.
Thank you for your cooperation.

windows mfc dll

2022-09-29 22:43

2 Answers

Is the MFC42.DLL symbol file (MFC42.PDB) loaded properly on the debugger?

Also, have you checked on WinDbg?
WinDbg Preview automatically downloads symbol files, so the function names inside the MFC42.DLL also appear on the call stack.


2022-09-29 22:43

To learn what DLL this is, use the filename instead of the number.

If it's a well-known DLL, you'll find out what it looks like if you search for it.
As you can see in the comments, MFC42.DLL is the DLL required to run programs that you created to use the Visual C++ 4.2 to 6.0 MFC libraries for dynamic links.

By the way, MFC42.DLL is ANSI/MBCS (Shift JIS in Japan) version and MFC42U.DLL is Unicode version.If there is a D, it is a debug version.

If you don't know what the search is for, you can guess (sometimes) by searching the file in Explorer on your PC, and by right-clicking on the file and looking at the properties.

"DLL Overview" is not known from "MFC42.#800", but what is the function of "800"?There is a possibility that can be examined.
However, it seems that you need a .LIB file to use when linking program builds, not DLL files.(The debug version of DLL might give you some information.)

Use the DUMPBIN in this VisualStudio or BuildTools etc.

Note
You can start this tool only from the Visual Studio command prompt. You cannot start from a system command prompt or from an explorer.

Learn more about numbers and how to use dumpbin to find information.
What is an Original number?

The legend is dumpbin/exports$dll | findstr$order and should be used as dumpbin/exports mfc42u.lib | findstr6928.

I tried dumpbin/exports mfc42u.dll|findstr800 for DLL, but it turned out to be 8000006D320[NONAME] and I couldn't get any information.
addition:
According to @sayuri's comment, if you can download and use the symbol information added below, you can understand it by DLL.

Also, all numbers and offsets that contain 800 are displayed as follows:(Pick up some of them because they are long)

 39900006800 [NONAME]
 8000006D320 [NONAME]
 94200074800 [NONAME]
 ...
1709000D7800 [NONAME]
180000144000 [NONAME]
 ...

I don't have MFC42.LIB, so I tried using dumpbin/exports mfc140.lib | findstr800 in MFC140.LIB, and I think this is the case with MFC140, since I saw the following at the end:

800??0 CMFCZoomKernel@@QEAA@XZ (public:__cdecl CMFCZoomKernel::CMFCZoomKernel(void))

Due to C++ naming rules, there is a lot of inorganic information, but you can guess from some of the strings.

When I saw @asimpleton's answer, I forgot that there was a way to do so.
The answer above is to look into situations where the program is not running.

In order to find out while moving, you don't have to worry about DLLs with information in VC++ (it might be better to install them including the source), but other than that, you need to set up the environment in this article.
VisualStudioIDE, not WinDbg.

Configuring Symbols and Executable Image Paths in WinDbg
Specify symbol (.pdb) and source files in Visual Studio debugger (C#, C++, Visual Basic, F#)
Windows Symbol Package
Downloading MFC Debug Information

Non-Microsoft DLLs should be available if the manufacturer has published them.
Create Legacy Symbol Package (.symbols.nupkg)
Create Symbol Package (.snupkg)
Debug NuGet Package


2022-09-29 22:43

If you have any answers or tips


© 2024 OneMinuteCode. All rights reserved.