What are the .cpp files in IDA disassembly [duplicate]

Question

I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden somewhere?

Here is an example: base\subsys\wsl\lxss\lxcmdlineshared\svccomm.cpp

Answer 1

I commented and then I've read malikcjm answer

So this is basically an extension of malikcjm's answer.

Suppose you have a code like this and load the compiled exe into ida

#include <stdio.h>
void main (void){
    printf("%s\n" ,__FILE__);
}

You will get the cpp file reference

these __FILE__, __LINE__ etc are predefined macros that are defined in the C++ Standard as well as some Microsoft-specific predefined macros

take a look PRE_DEFINED_MACROS for a discussion and usage of these predefined macros

these predefined macros are not restricted to debug mode alone; they can be used in release mode also

here is example code that uses them in release mode

#include <windows.h>
#pragma comment (lib , "test.lib")
#pragma comment (lib , "kernel32.lib")
#pragma comment (lib , "user32.lib")
_declspec (dllexport) int  AddNum(int a, int b);
char buff[0x100] = { 0 };
PCHAR timepass(int a, PCHAR b) {
    wsprintfA(buff,"%d %s\n%s\t%s\t%s\n", a,b,__FUNCTION__,__FUNCDNAME__,__FUNCSIG__);
    OutputDebugStringA(buff);
    wsprintfA(buff,"we are done passing time\n");
    return buff;    
}
int main(void) {
    wsprintfA(buff, "3 + 5 = %x\n", AddNum(3, 5));
    OutputDebugStringA(buff);
    wsprintfA(buff, "%s\n", __FILE__);
    OutputDebugStringA(buff);
    wsprintfA(buff, "%s\n", __DATE__);
    OutputDebugStringA(buff);
    wsprintfA(buff, "%d\n", __LINE__);
    OutputDebugStringA(buff);
    wsprintfA(buff, "%s\n", __func__);
    OutputDebugStringA(buff);
    OutputDebugStringA(timepass(1337 , "we are now going to pass time"));
    return 0;
}

compiled and linked with

 cl /nologo use%1.cpp /link /ENTRY:main /SUBSYSTEM:windows /RELEASE

executed in debugger would show

>cdb -c "g;q" usetest.exe | tail -n 13
DLL_PROCESS_ATTACH Called

3 + 5 = 8
usetest.cpp
Mar  1 2018
20
main
1337 we are now going to pass time
timepass        ?timepass@@YAPADHPAD@Z  char *__cdecl timepass(int,char *)
we are done passing time
DLL_PROCESS_DETACH Called
quit:

If a PDB is available we can get the so called leaks from them too an example of file paths from an ntdll pdb

e:\cvdump>cvdump -sf e:\SYMBOLS\ntdll.pdb\120028FA453F4CD5A6A404EC37396A582\ntdll.pdb >> leaks.txt

e:\cvdump>wc -l leaks.txt
860 leaks.txt

e:\cvdump>grep "daytona" leaks.txt  | grep ldrs
** Module: "o:\w7rtm.obj.x86fre\minkernel\ntdll\daytona\objfre\i386\ldrstart.obj"
** Module: "o:\w7rtm.obj.x86fre\minkernel\ntdll\daytona\objfre\i386\ldrsnap.obj"

Answer 2

There are no *.cpp files in disassembly. It looks like automatically generated string file file path. It's sometimes used for logging. It can be generated if somewhere in the source code __FILE__ preprocessor directive was used.

Answer 3

This is just a string in the binary file that, for some reason represents the file name and in this case a cpp file. Maybe this binary for some reason needs to access it on the system, or checks if they exists and does some work if so (or if not).

They are not hidden and unfortunately not available.