View Single Post
  #1  
Old 12-09-2015, 05:56
dummys dummys is offline
Friend
 
Join Date: Aug 2015
Posts: 16
Rept. Given: 0
Rept. Rcvd 4 Times in 4 Posts
Thanks Given: 1
Thanks Rcvd at 4 Times in 4 Posts
dummys Reputation: 4
Help on Reverse engineering MFC binaries

Hi guyz,

I'm reversing an application written in MFC statically linked and it's a pain in the ass. I already read and play with the https://tuts4you.com/download.php?view.2509 by Externalist and https://quequero.org/2008/08/guidelines-to-mfc-reversing/ but can't find what's in. I have successfully found many AFX_MSGMAP and used script to parse it and found several handler for ressource. The problem is:

.rdata:00440890 AFX_MSGMAP_ENTRY <111h, 0, 41Dh, 41Dh, 0Ch, offset sub_42C4BC>

Here the ressourceID must be 0x41d (1053) but I can't find it with ressource hacker. So where to find this ressourceID?
For example I found the function of a button called "ok", but the only action he is doing is to call CDialog::OnOK, if I look on the ms doc: https://msdn.microsoft.com/en-us/en-EN/library/66b3y2ab.aspx It says: "Override this method to perform actions when the OK button is activated"
My question is: How I can find if this function is overidded and how I can find the handler function ?
Thanks.
Reply With Quote