View Full Version : What are these? .?AV
FrankRizzo
May 6th, 2006, 11:09
When running IDA through some Win32 programs, I occasionally run across lines that say something like ".?AVCText".
Can anyone explain, or point me to an explaination of what these are? (I figure they might be useful!)
blabberer
May 6th, 2006, 11:45
probably you are talking about demangled names
for example blah::foo::faa::setdata
would be showing up as ?123##Abc_123_45@@ABC
there is an option some where to change them to a more human readable form
if you already know about demangled names then my be a copy paste of the whole line or the context would be able to generate a better answer
FrankRizzo
May 6th, 2006, 13:01
It's not a mangled C++ name. (BTW, the option to convert mangled names to REGULAR names is Alt-O, M, N. )
Lemme pull up a quick file here.. OK, it has .?AVtype_info as one, .?AVOoGraph is another one, .?AVOoGraph3D, etc.
These are something that IDA doesn't touch, they show up as ASCII, but DB'd as single bytes. I.E.
Code:
db 23h ; .
db 3Fh ; ?
db 41h ; A
db 56h ; V
naides
May 6th, 2006, 15:15
I may be wrong, but those are areas in the exe file that contain text, strings or symbols that IDA does noto recognize as code (Does not disassemble), but did not dare to call it data.
That is where the I(nteractive) of IDA come from.
If you recognize those bytes as DATA, highlight them, right click and tell IDA to make them into DATA (or type D on the kbd) , and they will turn into a string of some sort.
What you put as example looks like symbols (names) of imports coming from an application specific .dll that IDA does not recognize as such.
FrankRizzo
May 6th, 2006, 15:34
Those example symbols above are from 2 different apps from 2 different companies, and I've seen them all over!
I wonder if they're something that the compiler is throwing in to document something specific, and IDE 4.80 doesn't yet know about them?
MFC. I've reversed enough MFC programs to know that they are essentially fat that can be disregarded.
Googling "?AVtype_info" brings up a lot of rather interesting (but not too useful) results...
reverser
May 23rd, 2006, 11:46
These are part of RTTI (run-time type information) inserted by the compiler. See TypeDescriptor structure in this article:
https://www.openrce.org/articles/full_view/21
With some luck, you could indentify the vtables of the classes with those names (e.g. .?AVCText@@ is mangled 'class CText').
Big Red
May 23rd, 2006, 13:07
reverser got it right on there. I've used those exact symbols before when tracking stuff down, and in the program I've played around with, you can easily locate which VTables go with which names following pointers (though not 100% of the time). Occasionally I saw them used by some program routines, but it was very rare.
For that same program, I wrote an extractor which tracked down over 200 class names and sorted their VTables. It's possible to go from name to VTable this way, but there are no pointers so it's just searching. There were also structures for every class giving the exact inheritance patterns for each, which I also took advantage of. Very useful, in fact.
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.