Skip to content

Conversation

@oopsmishap
Copy link
Collaborator

Certain names like __security_check_cookie are using a weird state of demangling where the visible name is not the real name.

void __fastcall __security_check_cookie(uintptr_t StackCookie)
{
  if ( StackCookie != __security_cookie )
    __report_gsfailure();
}
idaapi.get_name_ea(0, '__security_check_cookie')  # Returns BADADDR
idaapi.get_name_ea(0, '@__security_check_cookie@4')  # Returns address

Simple solution is to create a map of the demangled named, MNG_NODEFINIT allows us to do this as this is the flags used in Hexrays (despite it having the longest comment saying not to use it)

#define MNG_NODEFINIT    0x00000008 // Inhibit everything except the main name
                                                                  // This flag is not recommended
                                                                  // for __fastcall/__stdcall GCC3 names
                                                                  // because there is a high probablity of
                                                                  // incorrect demangling. Use it only when
                                                                  // you are sure that the input is a
                                                                  // cygwin/mingw function name

@mrexodia mrexodia merged commit b96253b into mrexodia:main Mar 28, 2025
can1357 pushed a commit to can1357/ida-pro-mcp that referenced this pull request Dec 19, 2025
Added support to resolve demangled names found in HexRays output
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants