external methods naming models

Question

1.00/5 (2 votes)

See more:

some external method in PE files appear in complex view such this:

?ymdm_video_device_register_callback@@YAPAUtag_service_callback_handle@@PAUtag_service_handle@@P6AXHPAX1@Z1@Z

It is equivalent in Explorer Suite http://www.ntcore.com/exsuite.php[^] is:

struct tag_service_callback_handle * __cdecl ymdm_video_device_register_callback(struct tag_service_handle *,void (__cdecl*)(int,void *,void *),void *)

how can i translate first complex model to second

Posted 15-Feb-13 8:01am

ibrahim_ragab

Updated 15-Feb-13 8:06am

Abhishek Pant

v2

Add a Solution

Comments

Sergey Alexandrovich Kryukov 15-Feb-13 14:07pm

I wonder why? Even if you can translate it, what's the use? You cannot fully rely on naming model: it doesn't carry complete unambiguous information on the signature and parameter types.
With C++, people conduct this information using header files (it's a shame, but this is the C/C++ technology, very archaic...).
—SA

ibrahim_ragab 16-Feb-13 5:48am

in reverse engineering and de_compilers we need to return it back

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

H.Brydon · Accepted Answer · 2013-02-16T09:45:00

Translation from the second item to the first is called "name decoration" or (almost) "name mangling". Microsoft provides a tool for undecorating names called "undname.exe". To use it, open the command prompt for your compiler (eg. for VS2010, Start -> Microsoft Visual Studio 2010 -> Visual Studio Tools -> Visual Studio Command Prompt (VS2010)).

If you give the first item above to it as a parameter, it tells you the undecorated name:

d:\vs2010\VC>undname ?ymdm_video_device_register_callback@@YAPAUtag_service_callback_handle@@PAUtag_service_handle@@P6AXHPAX1@Z1@Z
Microsoft (R) C++ Name Undecorator
Copyright (C) Microsoft Corporation. All rights reserved.

Undecoration of :- "?ymdm_video_device_register_callback@@YAPAUtag_service_callback_handle@@PAUtag_service_handle@@P6AXHPAX1@Z1@Z"
is :- "struct tag_service_callback_handle * __cdecl ymdm_video_device_register_callback(struct tag_service_handle *,void (__cdecl*)(int,void *,void *)
,void *)"

d:\vs2010\VC>

[The lines above are wrapping - the undname command needs to be on one line...]

Sergey Alexandrovich Kryukov · Accepted Answer · 2013-02-15T08:09:00

Solution 1

Please see my comment to the question: I don't think it would make any sense. For some background, please see: http://en.wikipedia.org/wiki/Name_mangling[^].

Yes, I understand that you may be well familiar with this topic, but, first, see the references in this article; second, look critically at your problem.

—SA

Posted 15-Feb-13 8:09am

Sergey Alexandrovich Kryukov

Comments

ibrahim_ragab 16-Feb-13 4:43am

thank you very much

Sergey Alexandrovich Kryukov 16-Feb-13 19:09pm

You are welcome.
Good luck, call again.
—SA