0

I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary is exporting, e.g. @@Calculator@Initialize and @@Calculator@Finalize. The Initialize and Finalize are reminiscent of the initialization and finalization keywords of the Delphi unit construct.

Here is an excerpt of the output of dumpbin:

     45    0 001335BC @@Aaft@Finalize
     44    1 001335AC @@Aaft@Initialize
     13    2 000E78C8 @@Advreg@Finalize
     12    3 000E78B8 @@Advreg@Initialize

The only references to Borland's/Embarcadero's mangling scheme I have are these (one in English, one in German) which both describe the mangling scheme in C++:

None of the patterns in those references seem to apply to the @@ prefix of this symbol. One hypothetical interpretation of @@Foo@Initialize is "this symbol is for a special function Initialize", where the @@ prefix is used to avoid conflicts with a "regular" method Initialize in a class Foo.

Unfortunately I don't have access to TDUMP.exe so I can't demangle this myself in order to confirm my hypothesis. So how should I be interpreting these symbols matching the pattern @@<name>@Initializeand @@<name>@Finalize?

  • Are you sure it's @@Calculator@Initialize and not @Calculator@@Initialize ? – Igor Skochinsky Sep 5 '17 at 8:17
  • Quite sure. All the symbols are following the pattern @@<foo>@Initialize and @@<foo>@Finalize – John Källén Sep 5 '17 at 8:17
1

IDA demangles @@Unit1@Initialize as __linkproc__ Unit1::Initialize and looking for __linkproc__ yields some clues:

Modifiers (mutually exclusive)

UM_LINKER_PROC Special linker procedure (#pragma package)

case QUALIFIER: /* virdef flag or linker proc */

So looks like these functions are generated for the linker to ensure a specific initialization order. Apparently in C++ files this is achieved by using #pragma package, and I guess for Pascal units it happens automatically. (C++ Builder can use C++ and Pascal code in a single project; in fact most of VCL is implemented in Object Pascal and C++ Builder includes a Delphi compiler).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.