Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 12-09-2015, 05:56
dummys dummys is offline
Friend
 
Join Date: Aug 2015
Posts: 16
Rept. Given: 0
Rept. Rcvd 4 Times in 4 Posts
Thanks Given: 1
Thanks Rcvd at 4 Times in 4 Posts
dummys Reputation: 4
Help on Reverse engineering MFC binaries

Hi guyz,

I'm reversing an application written in MFC statically linked and it's a pain in the ass. I already read and play with the https://tuts4you.com/download.php?view.2509 by Externalist and https://quequero.org/2008/08/guidelines-to-mfc-reversing/ but can't find what's in. I have successfully found many AFX_MSGMAP and used script to parse it and found several handler for ressource. The problem is:

.rdata:00440890 AFX_MSGMAP_ENTRY <111h, 0, 41Dh, 41Dh, 0Ch, offset sub_42C4BC>

Here the ressourceID must be 0x41d (1053) but I can't find it with ressource hacker. So where to find this ressourceID?
For example I found the function of a button called "ok", but the only action he is doing is to call CDialog::OnOK, if I look on the ms doc: https://msdn.microsoft.com/en-us/en-EN/library/66b3y2ab.aspx It says: "Override this method to perform actions when the OK button is activated"
My question is: How I can find if this function is overidded and how I can find the handler function ?
Thanks.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Tips on reverse engineering mixed .NET/native binaries? jonwil General Discussion 6 11-07-2019 01:31
iOS Reverse Engineering sope General Discussion 0 05-13-2016 13:09
A new Reverse Engineering Site GufyMike General Discussion 11 10-16-2003 14:00


All times are GMT +8. The time now is 15:40.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )