When using IDA Pro I sometimes get names like ??0CSGString@@QAE@ABV0@@Z
in the idata segment. They look weird but that's because of name mangling. But sometimes I get names like __imp__DoPopup@4
which does not seem to be this way because of name mangling. In addition to that I also got the same function in the idata segment of another disassembly but with the name DoPopup
. So my question: Is the second one a valid function name? Or is it just a name IDA made up for it?
The @4
isn't C++ name mangling; it's a convention for stdcall functions to be decorated with the number of bytes of stack args they pop with ret 4
for example instead of a plain ret
. This produces linker errors instead of hard-to-debug runtime weirdness in case of a mismatch.
In C++, the function is extern "C" DoPopup(some_4byte_type)
.
We can't infer the return type.
__imp__foo
is the DLL import thunk for asm symbol _foo
in the DLL, so this isn't actually C++ _imp__DoPopup
. This is in addition to C++ name mangling, I assume, so if it hadn't been extern "C"
then you could maybe have had __imp__??0CSGString@@QAE@ABV0@@Z
for am import of that function.
Decorating symbols with a leading underscore is a thing for 32-bit Windows, although it doesn't apply here because __imp__
is its own form of decoration that replaces it.
32-bit fastcall also uses callee-pops with the same name mangling, but the first 2 args are passed in registers. (I forget whether the @n includes the space the register args would have used or not.)
Note that Windows x64 doesn't add a leading underscore to asm symbol names vs. their C name, and uses a different calling convention which is not callee-pops, so no @number decorations would be used there either.