Resolving ordinal_ imports from mfc140.dll

[randomstr1ng]

Currently I working on a Windows Application which has a single main executeable, a bunch of it's own dll's and in addition it is using a bunch of system dll's like kernel32.dll, user32.dll, and so on.

While analysing the program, I have a lot of calls for ordinal_mfc140_XXXX like below

In addition, I can see that there is no Type Library or anything reagards the mfc140.dll loaded.

I have loaded the same dll into Ghidra (on the same Windows machine) to see how it handles the calls. Ghidra is able to load the exports and resolve those.

Is there a elegant way how I can resolve this/get the same behavior like Ghidra has with Binary Ninja?
Can I export the calls in Ghidra and import them into Binary Ninja?

Thanks!

[plafosse]

Yes its pretty easy todo but you need to write some code.

from binaryninja import *

tl = TypeLibrary.new(Architecture['x86'], 'mfc140')
my_ordinals = [
    ("name", 0x1000),
]

ordinal_version = "ordinals_v1"
tl.store_metadata("ordinals", ordinal_version)
tl.store_metadata(ordinal_version, my_ordinals)
tl.write_to_file("mfc140.bntl")

Then you need to install this bntl in your: <Binary Ninja Home directory>/typlib/x86/

and I think that will work. We really do need to generate type libraries for all the MFC stuff

[plafosse]

As we're in the middle of a release process I don't have the time to add these to the product and test them but you these may be helpful to you:

MFCOrdinalTypeLibs.zip

[randomstr1ng]

Hi @plafosse,
thank you for your response and for all the .bntl files!

I generated my own .bntl as you had described above and placed it in the folder but for what ever reason it does not show up.
The same happens with the files you send me in the archive.

But, I did a debug log and I can see, that the mfc140.dll.bntl file is loaded from my location and it also uses it in the analysis:

If I have a look at the loaded types in the UI, the mfc140.dll is still missing, also the Ordinal call are there and have not been resolved.

Is there a platform mismatch or something? Appreciate any hint as I know you are busy with the release process.
Let me know if the debug log would help. (~100MB)

[plafosse]

Any chance you can share some binaries?

[randomstr1ng]

@plafosse sure - try this one: https://1drv.ms/u/s!AsS7Wq-A6cTAvDCcBYE6Zdm6Dvxf?e=MfqphT
(seems like the last upload had been already deleted.

thank you in advance!

[randomstr1ng]

@plafosse did you had a chance to have a look?