IDA 显示函数名称技巧

在IDA中，我们可以经常看到这种

 

all    memset
push    esi             ; unsigned int
call    ??_U@YAPAXI@Z   ; operator new[](uint)
push    esi             ; Size
push    0               ; Val
push    eax             ; Dst
mov     [esp+1C4h+var_184], eax
call    memset
add     esp, 20h
lea     ecx, [esp+1A4h+var_190]
call    ds:?GetLength@?$CSimpleStringT@D$00@ATL@@QBEHXZ ; ATL::CSimpleStringT<char,1>::GetLength(void)
push    eax
lea     ecx, [esp+1A8h+var_190]
call    ds:?GetBuffer@?$CSimpleStringT@D$00@ATL@@QAEPADH@Z ; ATL::CSimpleStringT<char,1>::GetBuffer(int)
mov     [esp+1A8h+var_18C], eax
lea     esi, ds:0[ebp*4]
lea     eax, [esi+1]
push    eax             ; unsigned int
call    ??_U@YAPAXI@Z   ; operator new[](uint)
mov     ebp, eax
lea     eax, [esi+1]

 

其中函数名称是乱码

要显示正确的函数名称很简单

 

Options->Demangled names...->Show demangled C++ names as:->Names

然后就变成这样了：

call    memset
push    esi             ; unsigned int
call    operator new[](uint)
push    esi             ; Size
push    0               ; Val
push    eax             ; Dst
mov     [esp+1C4h+var_184], eax
call    memset
add     esp, 20h
lea     ecx, [esp+1A4h+var_190]
call    ds:ATL::CSimpleStringT<char,1>::GetLength(void)
push    eax
lea     ecx, [esp+1A8h+var_190]
call    ds:ATL::CSimpleStringT<char,1>::GetBuffer(int)
mov     [esp+1A8h+var_18C], eax
lea     esi, ds:0[ebp*4]
lea     eax, [esi+1]
push    eax             ; unsigned int
call    operator new[](uint)
mov     ebp, eax
lea     eax, [esi+1]

 

这样是不是很爽？