I'm currently browsing through RTTI information available in an MSVC++2003 executable (writing an IDAPython script to recreate structs for the class hierarchy). Apparently, as visualized here, the RTTI Type Descriptor stores something like the name of the classes or their constructor:
.?AVexception@@
.?AUescaped_list_error@boost@@
.?AVruntime_error@stlp_std@@
However, it sports a mangling scheme I do not recognize yet. The name starts with a .
which, according to this wiki, is not even a valid start for a mangled MSVC name. IDA and an online name demangler also cannot demangle these names. According to these scripts (s. ms_rtti4.idc) these should map to:
typeid(struct exception)
typeid(struct boost::escaped_list_error)
typeid(struct stlp_std::runtime_error)
I tried removing the leading dot to get a valid start at least, but it is still invalid. Quickly writing an overly simplistic python line to at least fix namespaced class names...
return "::".join(reversed(name[4:-2].split("@")))
...it of course fails with generic type names, as with these classes here:
ns::FunctionBase (.?AVFunctionBase@ns@@)
ns::Z::P6AXPAX::?$FunctionT (.?AV?$FunctionT@P6AXPAX@Z@ns@@)
ns::Z::P6AHH::?$FunctionT (.?AV?$FunctionT@P6AHH@Z@ns@@)
ns::Z::P6AHPB_W::?$FunctionT (.?AV?$FunctionT@P6AHPB_W@Z@ns@@)
ns::Z::P6AHI::?$FunctionT (.?AV?$FunctionT@P6AHI@Z@ns@@)
I noticed removing the .?AU
or .?AV
prefix from those yields kinda useful results (missing the namespace sadly):
FunctionT@ns@@
FunctionT<void (__cdecl*)(void *)>
FunctionT<int (__cdecl*)(int)>
FunctionT<int (__cdecl*)(wchar_t const *)>
FunctionT<int (__cdecl*)(unsigned int)>
...but again that one now doesn't work for non-generic names.
I wonder if the RTTI Type Descriptor name scheme is documented, or if there is logic turning this into an actual RTTI name I can demangle with the usual tools?
typeid(struct xyz)
as added to my question now. I found a way to abuse demangling a valid ctor from it and then stripping out the class name which I post as an answer for now.