Ordinal values and .def files

 

Some DLLs, including some from Microsoft, may export their functions by ordinal value, instead of by the usual readable name.

 

However, having access to the module's original .def file means those ordinal values can be used to look up the symbol names to display in Memory Validator.

 

The .def file will contain the function names and ordinal values, allowing a DLL's exported ordinal value to be mapped to the symbol name.

 

For example, here's a small section of mfc90.def showing the ordinal values 332 to 335 and a selection of decorated names:

 

??0CBrush@@QEAA@K@Z @ 332 NONAME

??0CBrush@@QEAA@PEAVCBitmap@@@Z @ 333 NONAME

??0CByteArray@@QEAA@XZ @ 334 NONAME

??0CChevronOwnerDrawMenu@@QEAA@XZ @ 335 NONAME

 

You can use the ordinal handler dialog (below) to associate a def file with a DLL. These associations will persist between sessions.

 

If you need different ordinal configurations for different DLL usage, you can export this mapping between DLL and .def to a file, to be used at a later date.

 

 

The ordinal handler dialog

 

The ordinal handler dialog lets you manage which .def files are associated with which DLLs.

 

Settings menu Edit Settings... Symbols Symbols Misc page Manage Ordinals shows the ordinal handler dialog

 

 

 

•Add... shows the ordinal-to-function converter dialog, described below ,so you can add a new mapping
 

•Edit... opens a selected mapping in the ordinal-to-function converter dialog

 
Double clicking an item in the list also does this.
 

•Remove removes the selected associations from the list

 

•Remove All clears all the associations in the list

 
 

•Import... choose a previously saved set of associations to add to the list

 

•Load... as for Import, but replaces the contents of the list

 

•Save... saves the associations in the list to a .ord file of your choice

 

 

Switching usage of mapped names on and off

 

The option to switch the ordinal mapping on or off is in the global settings dialog:

 

Settings menu Edit Settings... Advanced Symbols Misc page Convert DLL exported function ordinals to symbols enable the ordinal to function name mapping

 

You'll need to tick this to enable the use of mapped names defined in the list above. If you don't, you won't see the names being used.

 

 

The ordinal-to-function converter dialog

 

After clicking Add... on the Ordinal Handler Dialog (above) you'll see the ordinal-to-function converter dialog below.

 

The basic process for adding a new mapping is to:

 

•choose a DLL

•find its matching .def file

•convert the ordinal values to symbol names

•add the file association to the Ordinal Handler dialog

 

This example shows the Microsoft MFC90.dll associated with its .def file:

 

 

 

Associating the DLL and .def files

 

In the ordinal-to-function converter dialog:

 

•DLL to examine... type or browse to enter the DLL you want to map

 

•Definition file to examine... type or browse to enter the .def file you want to associate with the DLL, or choose one from the drop-down list

 

If a .def file matching the name of the .dll exists in the same directory as the DLL, this will be set automatically.

 

•Convert Ordinals into Symbol Names convert the exported ordinals from the chosen DLL into symbol names using the specified .def file

 

All the ordinals and symbol names found will be displayed in the list at the bottom.

 

•OK closes the dialog and adds the association between the DLL and the .def to the ordinal handler dialog

 

 

 

Scanning for .def files

 

The .def files aren't always in the same directory as the DLLs and may be hard to find, so a search option is available.

 

Any .def files found during a scan can be used to extend or replace the drop-down list of the Definition file to examine... option above.

 

•Partial Scan... choose a folder and scan it for .def files

 

•Full Scan... scan all drives for .def files

 

While scanning, a progress dialog shows the search location and the number of .def files found:

 

 

•Stop stop the scan and show results found so far
 

•Cancel stop the scan and discard any results

 

When the scan is complete a dialog shows any .def files found:

 

 

•Add To List extend the drop-down list of the Definition file to examine... option by adding all the search results in the list
 

•Replace List as above but replaces the list rather than extending it

 

•Add adds an entry to the list so you can manually enter a file path
 

•Remove remove any selected items from the list

 

•Remove All clears the list
 

•Cancel closes the dialog, discarding the list of results