Package rekall :: Package plugins :: Package overlays :: Package windows :: Module pe_vtypes :: Class Demangler
[frames] | no frames]

Class Demangler

source code


A utility class to demangle VC++ names.

This is not a complete or accurate demangler, it simply extract the name and strips out args etc.

Ref: http://www.kegel.com/mangle.html

Instance Methods
 
__init__(self, metadata)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
DemangleName(self, mangled_name)
Returns the de-mangled name.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
  STRING_MANGLE_MAP = {'\\$AA': '', '\\$AN': '', '\\$CB': '!', '...
  SIMPLE_X86_CALL = re.compile(r'[_@]([A-Za-z0-9_]+)@(\d{1,3})$')
  FUNCTION_NAME_RE = re.compile(r'\?([A-Za-z0-9_]+)@')
Properties

Inherited from object: __class__

Method Details

__init__(self, metadata)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__
(inherited documentation)

DemangleName(self, mangled_name)

source code 

Returns the de-mangled name.

At this stage we don't really do proper demangling since we usually dont care about the prototype, nor c++ exports. In the future we should though.


Class Variable Details

STRING_MANGLE_MAP

Value:
{'\\$AA': '',
 '\\$AN': '',
 '\\$CB': '!',
 '\\$CD': '#',
 '\\$CF': '%',
 '\\$CG': '&',
 '\\$CI': '(',
 '\\$CJ': ')',
...