I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary is exporting, e.g. @@Calculator@Initialize
and @@Calculator@Finalize
. The Initialize
and Finalize
are reminiscent of the initialization
and finalization
keywords of the Delphi unit
construct.
Here is an excerpt of the output of dumpbin:
45 0 001335BC @@Aaft@Finalize
44 1 001335AC @@Aaft@Initialize
13 2 000E78C8 @@Advreg@Finalize
12 3 000E78B8 @@Advreg@Initialize
The only references to Borland's/Embarcadero's mangling scheme I have are these (one in English, one in German) which both describe the mangling scheme in C++:
- https://github.com/mildred/Lysaac/blob/master/doc/boa.utf8.txt
- http://edn.embarcadero.com/article/27758
None of the patterns in those references seem to apply to the @@
prefix of this symbol. One hypothetical interpretation of @@Foo@Initialize
is "this symbol is for a special function Initialize
", where the @@
prefix is used to avoid conflicts with a "regular" method Initialize
in a class Foo
.
Unfortunately I don't have access to TDUMP.exe so I can't demangle this myself in order to confirm my hypothesis. So how should I be interpreting these symbols matching the pattern @@<name>@Initialize
and @@<name>@Finalize
?
@@Calculator@Initialize
and not@Calculator@@Initialize
?@@<foo>@Initialize
and@@<foo>@Finalize