CODEWITHSUNDEEP
visual-c++reverse-engineeringmalwareidaollydbg
mohamed Abdel latief
mohamed Abdel latief

Reputation: 1

msvcp60.dll imported function names on idapro and ollydbg

I am currently reversing an executable that imports some functions from msvcp60.dll. When I open the executable in IDA Pro, the function names are very long, and it doesn't give any hint about what are they doing. Reversing all of these functions would be a waste of time right now.

So is there any way to get a meaningful names of these functions or at least interpret the listing showed in IDA? Here is an example of a function (the call in address 0040377C of the code):

.TEXT:00403767 loc_403767:                             ; CODE XREF: sub_402E1B+939j
.TEXT:00403767 mov     eax, ds:dword_B59B44
.TEXT:0040376C push    esi
.TEXT:0040376D imul    eax, 4Fh
.TEXT:00403770 add     eax, ds:dword_B52D34
.TEXT:00403776 shl     eax, 4
.TEXT:00403779 add     eax, ebx
.TEXT:0040377B push    eax
.TEXT:0040377C call    ds:??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ; std::operator!=<char,std::char_traits<char>,std::allocator<char>>(std::basic_string<char,std::char_traits<char>,std::allocator<char>> const &,char const *)
.TEXT:00403782 pop     ecx
.TEXT:00403783 test    al, al

Upvotes: 0

Views: 809

Answers (1)

Avery3R
Avery3R

Reputation: 3190

You are seeing a mangled name. Look closely you can see

std::operator!=(stuff)std::basic_string

It looks like it is calling the != operator on a string.

Upvotes: 2

Related Questions