Please enable JavaScript to view this site.

Memory Validator Help

 

Ordinal values and .def files

 

Some DLLs, including some from Microsoft, may export their functions by ordinal value, instead of by the usual readable name.

 

However, having access to the module's original .defexternalLink file means those ordinal values can be used to look up the symbol names to display in Memory Validator.

 

The .def file will contain the function names and ordinal values, allowing a DLL's exported ordinal value to be mapped to the symbol name.

 

For example, here's a small section of mfc90.def showing the ordinal values 332 to 335 and a selection of decorated namesexternalLink:

 

??0CBrush@@QEAA@K@Z @ 332 NONAME

??0CBrush@@QEAA@PEAVCBitmap@@@Z @ 333 NONAME

??0CByteArray@@QEAA@XZ @ 334 NONAME

??0CChevronOwnerDrawMenu@@QEAA@XZ @ 335 NONAME

 

You can use the ordinal handler dialog (below) to associate a def file with a DLL. These associations will persist between sessions.

 

If you need different ordinal configurations for different DLL usage, you can export this mapping between DLL and .def to a file, to be used at a later date.

 

 

The ordinal handler dialog

 

The ordinal handler dialog lets you manage which .def files are associated with which DLLs.

 

menu Settings menu instructionStep Edit Settings... instructionStep Symbols instructionStep Symbols Misc page instructionStep Manage Ordinals instructionStep shows the ordinal handler dialog

 

 ordinal-handling-dialog2

 

Add... instructionStep shows the ordinal-to-function converter dialog, described below ,so you can add a new mapping
 

Edit... instructionStep opens a selected mapping in the ordinal-to-function converter dialog

 
Double clicking an item in the list also does this.
 

Remove instructionStep removes the selected associations from the list

 

Remove All instructionStep clears all the associations in the list

 
 

Import... instructionStep choose a previously saved set of associations to add to the list

 

Load... instructionStep as for Import, but replaces the contents of the list

 

Save... instructionStep saves the associations in the list to a .ord file of your choice

 

 

Switching usage of mapped names on and off

 

The option to switch the ordinal mapping on or off is in the global settings dialog:

 

menu Settings menu instructionStep Edit Settings... instructionStep Advanced instructionStep Symbols Misc page instructionStep Convert DLL exported function ordinals to symbols instructionStep enable the ordinal to function name mapping

 

note You'll need to tick this to enable the use of mapped names defined in the list above. If you don't, you won't see the names being used.

 

 

The ordinal-to-function converter dialog

 

After clicking Add... on the Ordinal Handler Dialog (above) you'll see the ordinal-to-function converter dialog below.

 

The basic process for adding a new mapping is to:

 

choose a DLL

find its matching .def file

convert the ordinal values to symbol names

add the file association to the Ordinal Handler dialog

 

This example shows the Microsoft MFC90.dll associated with its .def file:

 

ordinal-to-function-converter

 

 

Associating the DLL and .def files

 

In the ordinal-to-function converter dialog:

 

DLL to examine... instructionStep type or browse to enter the DLL you want to map

 

Definition file to examine... instructionStep type or browse to enter the .def file you want to associate with the DLL, or choose one from the drop-down list

 

If a .def file matching the name of the .dll exists in the same directory as the DLL, this will be set automatically.

 

Convert Ordinals into Symbol Names instructionStep convert the exported ordinals from the chosen DLL into symbol names using the specified .def file

 

All the ordinals and symbol names found will be displayed in the list at the bottom.

 

OK instructionStep closes the dialog and adds the association between the DLL and the .def to the ordinal handler dialog

 

 

 

Scanning for .def files

 

The .def files aren't always in the same directory as the DLLs and may be hard to find, so a search option is available.

 

Any .def files found during a scan can be used to extend or replace the drop-down list of the Definition file to examine... option above.

 

Partial Scan... instructionStep choose a folder and scan it for .def files

 

Full Scan... instructionStep scan all drives for .def files

 

While scanning, a progress dialog shows the search location and the number of .def files found:

 

ordinal-handling-file-scan

 

Stop instructionStep stop the scan and show results found so far
 

Cancel instructionStep stop the scan and discard any results

 

When the scan is complete a dialog shows any .def files found:

 

ordinal-handling-file-scan-results

 

Add To List instructionStep extend the drop-down list of the Definition file to examine... option by adding all the search results in the list
 

Replace List instructionStep as above but replaces the list rather than extending it

 

Add instructionStep adds an entry to the list so you can manually enter a file path
 

Remove instructionStep remove any selected items from the list

 

Remove All instructionStep clears the list
 

Cancel instructionStep closes the dialog, discarding the list of results