Self-made MFC Message Response Locator + principle analysis

Source: Internet
Author: User

MFC has a message map table (MESSAGE_MAP), the message is distributed through this table to the corresponding function.

This is my self-made locator, from vc6.0 to now 2013 of the generated MFC can be used, fully static scan and processed dynamic base.

Here's a look at the MESSAGE_MAP structure:

struct Afx_msgmap_entry
UINT nmessage;
UINT Nlastid;
Uint_ptr NSig;
Afx_pmsg PFN;

PFN is the location of the response, and each class that inherits CWnd corresponds to a set of message-map tables, and the table is always in the. Rdata segment, and I think it's time to end it with an empty table full of 0, and see how to find this table.

Method 1

MFC message process is very long, any button press to go through more than 10 functions to go to the corresponding position, more than 10 functions refers to the R3, Count R0 More, if you are interested in the response function in the next endpoint and then see the stack frame.

In so many functions there is a key function onwndmsg (), the function inside to determine what the message, and then to distribute. It will call Getmessagemap () to get the position of the Message_map array, which can be called when the feature is positioned, called when always call DWORD ptr [eax+30h], after calling only a word mov eax,xxx then retn. XXX points to the location of the Message_map array. And I found out through the actual analysis that a rule is that a getmessagemap () is often the getmessagemap () of other classes.

Method 2

This structure has three key areas.

1. Nmessage Message ID

2, Nid,nlastid the control ID, in general, the two values are equal

3, PFN already said.

For example, press a button.

Nmessage = Wm_command

NCode = 0

NID = 1001 This ID can be found in the resource section, the specific self-check PE structure

Nlastid = 1001 Ibid.

NSig = 0x38 This involves a lot of things, it's not very important to us, first ignore it

PFN = 4074f0 This is the address of my onbuttonxxx ()

With these features, you can find them in the. Rdata.

Author qq1454322323

Self-made MFC Message Response Locator + principle analysis

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.