4

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump

DLL Name: msvcrt.dll
vma:  Hint/Ord Member-Name Bound-To
c2c68    1371  wcsncmp
c2c72    1017  _wcsnicmp
c2c7e    1229  iswdigit
c2c8a    1013  _wcslwr_s
c2c96    1225  iswalpha
c2ca2       5  ??0bad_cast@@QAE@ABV0@@Z
c2cbe      14  ??1bad_cast@@UAE@XZ
c2cd4    1241  localeconv
c2ce2    1256  memchr
c2cec    1304  strcspn
c2cf6    1292  sprintf_s
c2d02     884  _strtoi64

notice the 2 bad_cast functions. Why are they wierd looking like that? What does this syntax mean?

5

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names:

public: __thiscall bad_cast::bad_cast(class bad_cast const &)
public: virtual __thiscall bad_cast::~bad_cast(void)

So these functions are the constructor and the destructor for bad_cast objects, used to thrown an exception when a dynamic_cast to a reference type fails the run-time check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.