Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Call for Contribution: Demangler Scripts

Topic created on: November 22, 2007 02:40 CST by c1de0x .

Hi all,

Was chatting with Ero today and felt a desperate need for a C++ name demangler script, or rather a collection of compiler specific demangler scripts.

We thought that this would be a perfect 'project' to kick-of openrce-snippets.

So here it is: I'm calling for all able bodied python coders to contribute to a collection of demangling scripts. If you're interested in helping out, PM/mail/irc me.

To start with, a demangler for MSVC and one for gcc should take priority.

  neox   November 22, 2007 04:13.21 CST
hey c1de0x,
you are looking for something like c++filt (in g++), am I correct?

Is the final plan to use the python script with IDA to rename all demangled names or something else?


karthik

  neox   November 22, 2007 04:40.59 CST
btw, for MS VC++, Its a matter of calling UnDecorateSymbolName() in header Dbghelp.h

https://msdn2.microsoft.com/en-us/library/ms681400.aspx

  anonymouse     November 22, 2007 09:03.27 CST
if some one is looking for c++filt for msvc written in c++ they can take a look at nirvas (dannydulai) vc++ filt here

its commandline msvc demangler and comes along with source code

http://www.ishiboo.com/~nirva/Projects/vc++filt/

  c1de0x   November 22, 2007 11:22.28 CST
Thanks for your responses...

The idea is to have standalone python demangling scripts for use in other scripts (eg: pefile export name parsing).

  c1de0x   November 23, 2007 05:03.24 CST
anonymouse: that link doesn't implement the demangling algorithm, it just calls UnDecorateSymbolName.

neox/anonymouse: I'd prefer to have the demangling actually implemented in python so that it's flexible and portable.

karthik: IDA does symbol demangling, but these scripts could be used with any number of other tools, including paimei/pydbg, immdbg, etc...

Anyone have any pointers to 'specs' for symbol name decoration?

EDIT: I found this: http://sourceforge.net/project/showfiles.php?group_id=120520... anyone feel like translating it to python?

  loco13     November 23, 2007 07:24.26 CST
The leaked source code of windows contains a complete compilable undecorator...owned by the LANGAPI proyect ;)

  ero     November 23, 2007 10:01.53 CST
We need to break the tasks down and put them up in the Mechanical Turk... :-p

  igorsk     November 23, 2007 10:22.20 CST
There is a demangler in Wine's MSVCRT port.

Note: Registration is required to post to the forums.

There are 31,320 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit