Self-made MFC Message Response Locator + principle analysis

MFC has a message map table (MESSAGE_MAP), the message is distributed through this table to the corresponding function.

This is my self-made locator, from vc6.0 to now 2013 of the generated MFC can be used, fully static scan and processed dynamic base.

Here's a look at the MESSAGE_MAP structure:

struct Afx_msgmap_entry
{
UINT nmessage;
UINT NCode;
UINT NID;
UINT Nlastid;
Uint_ptr NSig;
Afx_pmsg PFN;
};

PFN is the location of the response, and each class that inherits CWnd corresponds to a set of message-map tables, and the table is always in the. Rdata segment, and I think it's time to end it with an empty table full of 0, and see how to find this table.

Method 1

MFC message process is very long, any button press to go through more than 10 functions to go to the corresponding position, more than 10 functions refers to the R3, Count R0 More, if you are interested in the response function in the next endpoint and then see the stack frame.

In so many functions there is a key function onwndmsg (), the function inside to determine what the message, and then to distribute. It will call Getmessagemap () to get the position of the Message_map array, which can be called when the feature is positioned, called when always call DWORD ptr [eax+30h], after calling only a word mov eax,xxx then retn. XXX points to the location of the Message_map array. And I found out through the actual analysis that a rule is that a getmessagemap () is often the getmessagemap () of other classes.

Method 2

This structure has three key areas.

1. Nmessage Message ID

2, Nid,nlastid the control ID, in general, the two values are equal

3, PFN already said.

For example, press a button.

Nmessage = Wm_command

NCode = 0

NID = 1001 This ID can be found in the resource section, the specific self-check PE structure

Nlastid = 1001 Ibid.

NSig = 0x38 This involves a lot of things, it's not very important to us, first ignore it

PFN = 4074f0 This is the address of my onbuttonxxx ()

With these features, you can find them in the. Rdata.

Author qq1454322323

Self-made MFC Message Response Locator + principle analysis