Search code examples
windowsassemblydisassemblyidaname-mangling

Ida Disassembly Name Mangling


When using IDA Pro I sometimes get names like ??0CSGString@@QAE@ABV0@@Z in the idata segment. They look weird but that's because of name mangling. But sometimes I get names like __imp__DoPopup@4 which does not seem to be this way because of name mangling. In addition to that I also got the same function in the idata segment of another disassembly but with the name DoPopup. So my question: Is the second one a valid function name? Or is it just a name IDA made up for it?


Solution

  • The @4 isn't C++ name mangling; it's a convention for stdcall functions to be decorated with the number of bytes of stack args they pop with ret 4 for example instead of a plain ret. This produces linker errors instead of hard-to-debug runtime weirdness in case of a mismatch.

    In C++, the function is extern "C" DoPopup(some_4byte_type).
    We can't infer the return type.

    __imp__foo is the DLL import thunk for asm symbol _foo in the DLL, so this isn't actually C++ _imp__DoPopup. This is in addition to C++ name mangling, I assume, so if it hadn't been extern "C" then you could maybe have had __imp__??0CSGString@@QAE@ABV0@@Z for am import of that function.

    Decorating symbols with a leading underscore is a thing for 32-bit Windows, although it doesn't apply here because __imp__ is its own form of decoration that replaces it.


    32-bit fastcall also uses callee-pops with the same name mangling, but the first 2 args are passed in registers. (I forget whether the @n includes the space the register args would have used or not.)


    Note that Windows x64 doesn't add a leading underscore to asm symbol names vs. their C name, and uses a different calling convention which is not callee-pops, so no @number decorations would be used there either.