Artifacts similar to "@YAXPAX@" within memory and IDA sessions

Question

When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention?

I believe theses strings are symbol references.

Answer 1

I believe this strange stuff comes up due to Name Mangling it is also known as name decoration. Name Mangling is mechanism used by compilers to pass semantically relevant information from compilers to linkers.

This is how Wikipedia describes Name Mangling for Visual C++ series of compilers:

Visual C++ name mangling is a mangling (decoration) scheme used in Microsoft Visual C++ series of compilers. It provides a way of encoding name and additional information about a function, structure, class or another datatype in order to pass more semantic information from the Microsoft Visual C++ compiler to its linker. Visual Studio and the Windows SDK (which includes the command line compilers) come with the program undname which may be invoked to obtain the C-style function prototype encoded in a mangled name. The information below has been mostly reverse-engineered. There is no official documentation for the actual algorithm used.

Answer 2

(Slightly off-topic)

c++filt is a very useful utility for de-mangling on Unix. I am not sure it is available in Visual Studio as well, but this is a simple implementation you can compile. Compare output (g++, not VC):

 $ nm a.out
 0000000100001040 S _NXArgc
 0000000100001048 S _NXArgv
 0000000100000d40 T __ZN6complxC1Edd
 0000000100000d10 T __ZN6complxC2Edd
 0000000100000d70 T __ZNK6complxplERKS_
 0000000100001058 S ___progname
 0000000100000000 T __mh_execute_header
 0000000100001050 S _environ
                  U _exit
 0000000100000e20 T _main
 0000000100001000 s _pvars
                  U dyld_stub_binder
 0000000100000cd0 T start

With c++filt:

 $ nm a.out |c++filt
 0000000100001040 S _NXArgc
 0000000100001048 S _NXArgv
 0000000100000d40 T complx::complx(double, double)
 0000000100000d10 T complx::complx(double, double)
 0000000100000d70 T complx::operator+(complx const&) const
 0000000100001058 S ___progname
 0000000100000000 T __mh_execute_header
 0000000100001050 S _environ
                  U _exit
 0000000100000e20 T _main
 0000000100001000 short _pvars
                  U dyld_stub_binder
 0000000100000cd0 T start

Answer 3

Just a small tip in case you didn't know: You can demangle the names inside IDA via Options -> Demangled names...

I believe default is demangle the name in the comments, but you can also change that to the function name itself. Takes away some clutter!

Answer 4

for vc++ name demangling you can use

vc++filt

it is a small wrapper over dbghelp Function UnDecorateSymbolname() that takes the mangled string and prints out demangled names back to the console see below for a snippet

??3@YAXPAX@Z
void __cdecl operator delete(void *)
?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z
void __cdecl AFXSetTopLevelFrame(class CFrameWnd *)

snippet

int _tmain(int argc, _TCHAR* argv[])
{
    char buff[0x100];
    UnDecorateSymbolName("??3@YAXPAX@Z",buff,0xf0,UNDNAME_COMPLETE);
    printf("%s\n",buff);
    return 0;
}

output

void __cdecl operator delete(void *)

Answer 5

There is a ruby gem that unmangles C++ names. Its doesn't support GCC yet though what you have there is MSVC.

You could drop this in a ruby shoes app have a name unmangler gui pretty quickly.

Usage:

require 'unmangler'

puts Unmangler.unmangle "??3@YAXPAX@Z"
puts Unmangler.unmangle "?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z"

# output:
# void __cdecl operator delete(void *)
# void __cdecl AFXSetTopLevelFrame(class CFrameWnd *)