0

I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or if I used the wrong terminology.

I am reversing a mach-0 binary with IDA. When I examine it, I find that there are hundreds of functions with weird names, like this

j___ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_

Now, this doesn't look like pure junk. From it I can 'extract' the following: char_traits, allocator, basic_string.

Apparently it does something with strings, as before there are the following instructions:

lea rsi, goodWork ; "Good work!"
lea rdx, _cido ; _cido in IDA is shown to do -> and [rax], eax ; I have no idea what that means
lea rdi, [rbp+var] ; the only occurrence of var before is at the start -> var = qword ptr - 1C0H ; as always, no idea of what is this
call to_the_function_I_wrote_before
jmp $+5

Is there a technique/way of knowing whatever this function does?

EDIT:

This has been flagged as a duplicate. It's not. The question you've linked only demangles the function name, which is a thing that IDA automatically does.

I need to understand whatever the hell this function does. The demangled function name is to me as helpful as the mangled one. I don't get it. I need a bit of guidance with that.

  • Possible duplicate of Wierd names in import table – usr2564301 Dec 29 '18 at 0:09
  • .. Using the online demangler on your name results in the slightly bewildering j__std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > std::__1::operator+<char, std::__1::char_traits<char>, std::__1::allocator<char> >(char const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) – originally, probably some typedefs or classes or summink like that. – usr2564301 Dec 29 '18 at 0:13
  • Re your edit, it may be useful to post the demangled name to StackOverflow since it’s more of a programming question than RE per se – Igor Skochinsky Dec 29 '18 at 15:00
  • The _cido pointer equals to address of and [rax], eax, because IDA shows you data section as code section. It may however be a pointer to char, a table of ints, a pointer to pointer to pointer. That is, a pointer to almost anything. – anx199 Dec 29 '18 at 17:37
3

This is actually quite a straightforward C++ string function. It's just that, behind the scenes, the C++ std::string class is actually a typedef of a template.

typedef basic_string<char> string;

basic_string itself is declared as -

template< class CharT, 
          class Traits = std::char_traits<CharT>, 
          class Allocator = std::allocator<CharT>
        > class basic_string;

In other words, a std::string is really a -

std::basic_string< char, std::char_traits<char>, std::allocator<char> >

Applying this in reverse to your mangled name and (and removing the __1's - see below) your function is simply the standard library string function -

std::string operator+( char const* lhs, std::string const& rhs )

This concatenates a C style string and a std::string, returning the result as a new std::string.

This function is called from x86-64 assembly language as follows -

  • rdi is a pointer to caller allocated memory for the returned std::string
  • rsi is the first argument and hence a pointer to a C style (zero terminated) string
  • rdx is the second argument and hence a reference (or pointer is assembly language terms) to a C++ std::string

Details on calling convention can be found here AMD64 ABI


In the above, I've ignored the __1 parts of the symbol. For details on where these come from see the following questions:

  • This is brilliant. Thanks. One thing though, I still don't get how you managed to figure out that the function concatenates a C string and an std::string. I guess that basic_string is the C++ string, but where is the C string? and where is the concatenator part? – A. Dandelion Dec 30 '18 at 11:25
  • 1
    @A.Dandelion In std::basic_string<char, std::char_traits<char>, std::allocator<char>> std::operator+<char, std::char_traits<char>, std::allocator<char>> (char const*, std::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) replace all the std::basic_string<char, std::char_traits<char>, std::allocator<char>> with std::string (std::string is just a typedef for that). It gives you: std::string std::operator+<char, std::char_traits<char>, std::allocator<char>> (char const*, std::string const&). – anx199 Dec 30 '18 at 14:19
  • @A.Dandelion Now, std::operator+<char, std::char_traits<char>, std::allocator<char>> means that this operator belongs to class <char, std::char_traits<char>, std::allocator<char>, which is std::string. Therefore, it can be shortened to: std::string std::string::operator+(char const*, std::string const&). – anx199 Dec 30 '18 at 14:20
  • @anx199 Thanks. I think I am starting to get it. Isn't there a tool that does this for me though? – A. Dandelion Dec 30 '18 at 14:21

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.