I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or if I used the wrong terminology.

I am reversing a mach-0 binary with IDA. When I examine it, I find that there are hundreds of functions with weird names, like this


Now, this doesn't look like pure junk. From it I can 'extract' the following: char_traits, allocator, basic_string.

Apparently it does something with strings, as before there are the following instructions:

lea rsi, goodWork ; "Good work!"
lea rdx, _cido ; _cido in IDA is shown to do -> and [rax], eax ; I have no idea what that means
lea rdi, [rbp+var] ; the only occurrence of var before is at the start -> var = qword ptr - 1C0H ; as always, no idea of what is this
call to_the_function_I_wrote_before
jmp $+5

Is there a technique/way of knowing whatever this function does?


This has been flagged as a duplicate. It's not. The question you've linked only demangles the function name, which is a thing that IDA automatically does.

I need to understand whatever the hell this function does. The demangled function name is to me as helpful as the mangled one. I don't get it. I need a bit of guidance with that.

  • Possible duplicate of Wierd names in import table
    – Jongware
    Dec 29, 2018 at 0:09
  • .. Using the online demangler on your name results in the slightly bewildering j__std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > std::__1::operator+<char, std::__1::char_traits<char>, std::__1::allocator<char> >(char const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) – originally, probably some typedefs or classes or summink like that.
    – Jongware
    Dec 29, 2018 at 0:13
  • Re your edit, it may be useful to post the demangled name to StackOverflow since it’s more of a programming question than RE per se
    – Igor Skochinsky
    Dec 29, 2018 at 15:00
  • The _cido pointer equals to address of and [rax], eax, because IDA shows you data section as code section. It may however be a pointer to char, a table of ints, a pointer to pointer to pointer. That is, a pointer to almost anything.
    – anx199
    Dec 29, 2018 at 17:37

1 Answer 1


This is actually quite a straightforward C++ string function. It's just that, behind the scenes, the C++ std::string class is actually a typedef of a template.

typedef basic_string<char> string;

basic_string itself is declared as -

template< class CharT, 
          class Traits = std::char_traits<CharT>, 
          class Allocator = std::allocator<CharT>
        > class basic_string;

In other words, a std::string is really a -

std::basic_string< char, std::char_traits<char>, std::allocator<char> >

Applying this in reverse to your mangled name and (and removing the __1's - see below) your function is simply the standard library string function -

std::string operator+( char const* lhs, std::string const& rhs )

This concatenates a C style string and a std::string, returning the result as a new std::string.

This function is called from x86-64 assembly language as follows -

  • rdi is a pointer to caller allocated memory for the returned std::string
  • rsi is the first argument and hence a pointer to a C style (zero terminated) string
  • rdx is the second argument and hence a reference (or pointer is assembly language terms) to a C++ std::string

Details on calling convention can be found here AMD64 ABI

In the above, I've ignored the __1 parts of the symbol. For details on where these come from see the following questions:

  • This is brilliant. Thanks. One thing though, I still don't get how you managed to figure out that the function concatenates a C string and an std::string. I guess that basic_string is the C++ string, but where is the C string? and where is the concatenator part? Dec 30, 2018 at 11:25
  • 1
    @A.Dandelion In std::basic_string<char, std::char_traits<char>, std::allocator<char>> std::operator+<char, std::char_traits<char>, std::allocator<char>> (char const*, std::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) replace all the std::basic_string<char, std::char_traits<char>, std::allocator<char>> with std::string (std::string is just a typedef for that). It gives you: std::string std::operator+<char, std::char_traits<char>, std::allocator<char>> (char const*, std::string const&).
    – anx199
    Dec 30, 2018 at 14:19
  • @A.Dandelion Now, std::operator+<char, std::char_traits<char>, std::allocator<char>> means that this operator belongs to class <char, std::char_traits<char>, std::allocator<char>, which is std::string. Therefore, it can be shortened to: std::string std::string::operator+(char const*, std::string const&).
    – anx199
    Dec 30, 2018 at 14:20
  • @anx199 Thanks. I think I am starting to get it. Isn't there a tool that does this for me though? Dec 30, 2018 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.