All geek questions in one place

Cancel export functions in Python

I am trying to reset all calls to imported API functions for a set of PE files.

I noticed that most PE files have a bunch of "weird" import functions. This significantly increases the number of unique function calls, although I feel that many of them are the same function calls.

After further research, I found out that this is due to a name change, and I'm currently looking for a solution to be able to get the original function call names (in the sense that it is a little more readable and maybe this can decrease my number of unique calls functions) in Python , if possible, and not in C ++.

Some examples of what I get:

?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ

against

RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
+4
1

++ . "" .

- . Windows undname, * nix nm, demangle, c++filt .

- , . , LLVM Itanium ABI demangler. GCC - .

+2

Source: https://habr.com/ru/post/1682099/

More articles:


All Articles