Click here to Skip to main content
11,434,743 members (46,317 online)
Rate this: bad
good
Please Sign up or sign in to vote.
See more: C++
some external method in PE files appear in complex view such this:

?ymdm_video_device_register_callback@@YAPAUtag_service_callback_handle@@PAUtag_service_handle@@P6AXHPAX1@Z1@Z 
It is equivalent in Explorer Suite http://www.ntcore.com/exsuite.php[^] is:

struct tag_service_callback_handle * __cdecl ymdm_video_device_register_callback(struct tag_service_handle *,void (__cdecl*)(int,void *,void *),void *)

how can i translate first complex model to second
Posted 15-Feb-13 9:01am
Edited 15-Feb-13 9:06am
v2
Comments
Sergey Alexandrovich Kryukov at 15-Feb-13 14:07pm
   
I wonder why? Even if you can translate it, what's the use? You cannot fully rely on naming model: it doesn't carry complete unambiguous information on the signature and parameter types.
With C++, people conduct this information using header files (it's a shame, but this is the C/C++ technology, very archaic...).
—SA
ibrahim_ragab at 16-Feb-13 5:48am
   
in reverse engineering and de_compilers we need to return it back
Rate this: bad
good
Please Sign up or sign in to vote.

Solution 2

Translation from the second item to the first is called "name decoration" or (almost) "name mangling". Microsoft provides a tool for undecorating names called "undname.exe". To use it, open the command prompt for your compiler (eg. for VS2010, Start -> Microsoft Visual Studio 2010 -> Visual Studio Tools -> Visual Studio Command Prompt (VS2010)).

If you give the first item above to it as a parameter, it tells you the undecorated name:

d:\vs2010\VC>undname ?ymdm_video_device_register_callback@@YAPAUtag_service_callback_handle@@PAUtag_service_handle@@P6AXHPAX1@Z1@Z
Microsoft (R) C++ Name Undecorator
Copyright (C) Microsoft Corporation. All rights reserved.

Undecoration of :- "?ymdm_video_device_register_callback@@YAPAUtag_service_callback_handle@@PAUtag_service_handle@@P6AXHPAX1@Z1@Z"
is :- "struct tag_service_callback_handle * __cdecl ymdm_video_device_register_callback(struct tag_service_handle *,void (__cdecl*)(int,void *,void *)
,void *)"

d:\vs2010\VC>

[The lines above are wrapping - the undname command needs to be on one line...]
  Permalink  
Comments
ibrahim_ragab at 20-Feb-13 7:19am
   
thank you my brother
Rate this: bad
good
Please Sign up or sign in to vote.

Solution 1

Please see my comment to the question: I don't think it would make any sense. For some background, please see: http://en.wikipedia.org/wiki/Name_mangling[^].

Yes, I understand that you may be well familiar with this topic, but, first, see the references in this article; second, look critically at your problem.

—SA
  Permalink  
Comments
ibrahim_ragab at 16-Feb-13 4:43am
   
thank you very much
Sergey Alexandrovich Kryukov at 16-Feb-13 19:09pm
   
You are welcome.
Good luck, call again.
—SA

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



Advertise | Privacy | Mobile
Web04 | 2.8.150428.2 | Last Updated 16 Feb 2013
Copyright © CodeProject, 1999-2015
All Rights Reserved. Terms of Service
Layout: fixed | fluid

CodeProject, 503-250 Ferrand Drive Toronto Ontario, M3C 3G8 Canada +1 416-849-8900 x 100