How do I interpret the mangled functions name?

Question

I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or if I used the wrong terminology.

I am reversing a mach-0 binary with IDA. When I examine it, I find that there are hundreds of functions with weird names, like this

j___ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_

Now, this doesn't look like pure junk. From it I can 'extract' the following: char_traits, allocator, basic_string.

Apparently it does something with strings, as before there are the following instructions:

lea rsi, goodWork ; "Good work!"
lea rdx, _cido ; _cido in IDA is shown to do -> and [rax], eax ; I have no idea what that means
lea rdi, [rbp+var] ; the only occurrence of var before is at the start -> var = qword ptr - 1C0H ; as always, no idea of what is this
call to_the_function_I_wrote_before
jmp $+5

Is there a technique/way of knowing whatever this function does?

EDIT:

This has been flagged as a duplicate. It's not. The question you've linked only demangles the function name, which is a thing that IDA automatically does.

I need to understand whatever the hell this function does. The demangled function name is to me as helpful as the mangled one. I don't get it. I need a bit of guidance with that.

Answer 1

This is actually quite a straightforward C++ string function. It's just that, behind the scenes, the C++ std::string class is actually a typedef of a template.

typedef basic_string<char> string;

basic_string itself is declared as -

template< class CharT, 
          class Traits = std::char_traits<CharT>, 
          class Allocator = std::allocator<CharT>
        > class basic_string;

In other words, a std::string is really a -

std::basic_string< char, std::char_traits<char>, std::allocator<char> >

Applying this in reverse to your mangled name and (and removing the __1's - see below) your function is simply the standard library string function -

std::string operator+( char const* lhs, std::string const& rhs )

This concatenates a C style string and a std::string, returning the result as a new std::string.

This function is called from x86-64 assembly language as follows -

• rdi is a pointer to caller allocated memory for the returned std::string
• rsi is the first argument and hence a pointer to a C style (zero terminated) string
• rdx is the second argument and hence a reference (or pointer is assembly language terms) to a C++ std::string

Details on calling convention can be found here AMD64 ABI

---

In the above, I've ignored the __1 parts of the symbol. For details on where these come from see the following questions:

• Where does the __1 come from when using LLVM's libc++
• What are inline namespaces for?