Some DLLs, including some from Microsoft, may export their functions by ordinal value, instead of by the usual readable name.
However, having access to the module's original .def file means those ordinal values can be used to look up the symbol names to display in Memory Validator.
The .def file will contain the function names and ordinal values, allowing a DLL's exported ordinal value to be mapped to the symbol name.
For example, here's a small section of mfc90.def showing the ordinal values 332 to 335 and a selection of decorated names:
??0CBrush@@QEAA@K@Z @ 332 NONAME
??0CBrush@@QEAA@PEAVCBitmap@@@Z @ 333 NONAME
??0CByteArray@@QEAA@XZ @ 334 NONAME
??0CChevronOwnerDrawMenu@@QEAA@XZ @ 335 NONAME
You can use the ordinal handler dialog (below) to associate a def file with a DLL. These associations will persist between sessions.
If you need different ordinal configurations for different DLL usage, you can export this mapping between DLL and .def to a file, to be used at a later date.
The ordinal handler dialog lets you manage which .def files are associated with which DLLs.
Settings menu Edit Settings... Symbols Symbols Misc page Manage Ordinals shows the ordinal handler dialog
•Add... shows the ordinal-to-function converter dialog, described below ,so you can add a new mapping
•Edit... opens a selected mapping in the ordinal-to-function converter dialog
Double clicking an item in the list also does this.
•Remove removes the selected associations from the list
•Remove All clears all the associations in the list
•Import... choose a previously saved set of associations to add to the list
•Load... as for Import, but replaces the contents of the list
•Save... saves the associations in the list to a .ord file of your choice
The option to switch the ordinal mapping on or off is in the global settings dialog:
Settings menu Edit Settings... Advanced Symbols Misc page Convert DLL exported function ordinals to symbols enable the ordinal to function name mapping
You'll need to tick this to enable the use of mapped names defined in the list above. If you don't, you won't see the names being used.
After clicking Add... on the Ordinal Handler Dialog (above) you'll see the ordinal-to-function converter dialog below.
The basic process for adding a new mapping is to:
•choose a DLL
•find its matching .def file
•convert the ordinal values to symbol names
•add the file association to the Ordinal Handler dialog
This example shows the Microsoft MFC90.dll associated with its .def file:
In the ordinal-to-function converter dialog:
•DLL to examine... type or browse to enter the DLL you want to map
•Definition file to examine... type or browse to enter the .def file you want to associate with the DLL, or choose one from the drop-down list
If a .def file matching the name of the .dll exists in the same directory as the DLL, this will be set automatically.
•Convert Ordinals into Symbol Names convert the exported ordinals from the chosen DLL into symbol names using the specified .def file
All the ordinals and symbol names found will be displayed in the list at the bottom.
•OK closes the dialog and adds the association between the DLL and the .def to the ordinal handler dialog
The .def files aren't always in the same directory as the DLLs and may be hard to find, so a search option is available.
Any .def files found during a scan can be used to extend or replace the drop-down list of the Definition file to examine... option above.
•Partial Scan... choose a folder and scan it for .def files
•Full Scan... scan all drives for .def files
While scanning, a progress dialog shows the search location and the number of .def files found:
•Stop stop the scan and show results found so far
•Cancel stop the scan and discard any results
When the scan is complete a dialog shows any .def files found:
•Add To List extend the drop-down list of the Definition file to examine... option by adding all the search results in the list
•Replace List as above but replaces the list rather than extending it
•Add adds an entry to the list so you can manually enter a file path
•Remove remove any selected items from the list
•Remove All clears the list
•Cancel closes the dialog, discarding the list of results