I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden somewhere?

Here is an example: base\subsys\wsl\lxss\lxcmdlineshared\svccomm.cpp


  • Better look in pseudocode, but I suppose sub_140004430 is assert or log function not just print. Also notice 0x4A (174 in dec) most likely it is line number.
    – mblw
    Commented Jun 1, 2023 at 10:13

3 Answers 3


I commented and then I've read malikcjm answer

So this is basically an extension of malikcjm's answer.

Suppose you have a code like this and load the compiled exe into ida

#include <stdio.h>
void main (void){
    printf("%s\n" ,__FILE__);

You will get the cpp file reference

enter image description here

these __FILE__, __LINE__ etc are predefined macros that are defined in the C++ Standard as well as some Microsoft-specific predefined macros

take a look PRE_DEFINED_MACROS for a discussion and usage of these predefined macros

these predefined macros are not restricted to debug mode alone; they can be used in release mode also

here is example code that uses them in release mode

#include <windows.h>
#pragma comment (lib , "test.lib")
#pragma comment (lib , "kernel32.lib")
#pragma comment (lib , "user32.lib")
_declspec (dllexport) int  AddNum(int a, int b);
char buff[0x100] = { 0 };
PCHAR timepass(int a, PCHAR b) {
    wsprintfA(buff,"%d %s\n%s\t%s\t%s\n", a,b,__FUNCTION__,__FUNCDNAME__,__FUNCSIG__);
    wsprintfA(buff,"we are done passing time\n");
    return buff;    
int main(void) {
    wsprintfA(buff, "3 + 5 = %x\n", AddNum(3, 5));
    wsprintfA(buff, "%s\n", __FILE__);
    wsprintfA(buff, "%s\n", __DATE__);
    wsprintfA(buff, "%d\n", __LINE__);
    wsprintfA(buff, "%s\n", __func__);
    OutputDebugStringA(timepass(1337 , "we are now going to pass time"));
    return 0;

compiled and linked with

 cl /nologo use%1.cpp /link /ENTRY:main /SUBSYSTEM:windows /RELEASE

executed in debugger would show

>cdb -c "g;q" usetest.exe | tail -n 13

3 + 5 = 8
Mar  1 2018
1337 we are now going to pass time
timepass        ?timepass@@YAPADHPAD@Z  char *__cdecl timepass(int,char *)
we are done passing time

If a PDB is available we can get the so called leaks from them too an example of file paths from an ntdll pdb

e:\cvdump>cvdump -sf e:\SYMBOLS\ntdll.pdb\120028FA453F4CD5A6A404EC37396A582\ntdll.pdb >> leaks.txt

e:\cvdump>wc -l leaks.txt
860 leaks.txt

e:\cvdump>grep "daytona" leaks.txt  | grep ldrs
** Module: "o:\w7rtm.obj.x86fre\minkernel\ntdll\daytona\objfre\i386\ldrstart.obj"
** Module: "o:\w7rtm.obj.x86fre\minkernel\ntdll\daytona\objfre\i386\ldrsnap.obj"
  • this might be some kind of debug messages I guess.. Commented Mar 1, 2018 at 7:26
  • @PawełŁukasik those are predefined macros they are expanded to thier current values by preprocessor prior to compiling the code i added a link in the answer take a look
    – blabb
    Commented Mar 1, 2018 at 7:45
  • I know the FILE is a predefined, but I was commenting the fact of the fact of using it in a production code. I would expect to see it in Debug mode Commented Mar 1, 2018 at 7:48
  • @PawełŁukasik no they are not restricted to debug mode you can happily use them in release mode also i added a code sample too
    – blabb
    Commented Mar 1, 2018 at 8:58
  • yes, I also know that :) but I was more wondering why would they be left there for release mode :) it's leaking a bit of info Commented Mar 1, 2018 at 9:00

There are no *.cpp files in disassembly. It looks like automatically generated string file file path. It's sometimes used for logging. It can be generated if somewhere in the source code __FILE__ preprocessor directive was used.


This is just a string in the binary file that, for some reason represents the file name and in this case a cpp file. Maybe this binary for some reason needs to access it on the system, or checks if they exists and does some work if so (or if not).

They are not hidden and unfortunately not available.

  • Is it a dead end? Should I care those string values?
    – Biswapriyo
    Commented Feb 28, 2018 at 21:36
  • it depends on the binary. Google search gives some links to Ubuntu subsystem for Windows - is that what you are looking at? Commented Feb 28, 2018 at 22:10
  • 1
    yes wsl.exe is linux subsystem for windows and those file names are src files that were used to compile (it remains there for using __ FILE __ debugprints
    – blabb
    Commented Feb 28, 2018 at 22:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.