msvcp60.dll 在 idapro 和 ollydbg 上导入函数名称
我目前正在逆向从 msvcp60.dll 导入一些函数的可执行文件。当我在 IDA Pro 中打开可执行文件时，函数名称非常长，并且没有给出任何关于它们在做什么的提示。现在反转所有这些功能将是浪费时间。
那么有没有办法获得这些函数的有意义的名称或者至少解释 IDA 中显示的列表呢？下面是一个函数示例（代码中地址 0040377C 的调用）：
.TEXT:00403767 loc_403767: ; CODE XREF: sub_402E1B+939j
.TEXT:00403767 mov eax, ds:dword_B59B44
.TEXT:0040376C push esi
.TEXT:0040376D imul eax, 4Fh
.TEXT:00403770 add eax, ds:dword_B52D34
.TEXT:00403776 shl eax, 4
.TEXT:00403779 add eax, ebx
.TEXT:0040377B push eax
.TEXT:0040377C call ds:??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ; std::operator!=<char,std::char_traits<char>,std::allocator<char>>(std::basic_string<char,std::char_traits<char>,std::allocator<char>> const &,char const *)
.TEXT:00403782 pop ecx
.TEXT:00403783 test al, al
I am currently reversing an executable that imports some functions from msvcp60.dll. When I open the executable in IDA Pro, the function names are very long, and it doesn't give any hint about what are they doing. Reversing all of these functions would be a waste of time right now.
So is there any way to get a meaningful names of these functions or at least interpret the listing showed in IDA? Here is an example of a function (the call in address 0040377C of the code):
.TEXT:00403767 loc_403767: ; CODE XREF: sub_402E1B+939j
.TEXT:00403767 mov eax, ds:dword_B59B44
.TEXT:0040376C push esi
.TEXT:0040376D imul eax, 4Fh
.TEXT:00403770 add eax, ds:dword_B52D34
.TEXT:00403776 shl eax, 4
.TEXT:00403779 add eax, ebx
.TEXT:0040377B push eax
.TEXT:0040377C call ds:??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ; std::operator!=<char,std::char_traits<char>,std::allocator<char>>(std::basic_string<char,std::char_traits<char>,std::allocator<char>> const &,char const *)
.TEXT:00403782 pop ecx
.TEXT:00403783 test al, al
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您看到的是一个损坏的名称。仔细观察，您会发现
它看起来像是在对字符串调用 != 运算符。
You are seeing a mangled name. Look closely you can see
It looks like it is calling the != operator on a string.