swiftx86disassemblyhopper

Swift mangled function name mapping


How does the Hopper disassembler understand what is the function's name?

For example, I have a simple Swift function named function(), and after disassembling the executable with that function Hopper shows me that it's mangled name is __T04file8functionyy. I can find the location of these symbols in the executable file, but I can't find how does it map the address of the function with it's name.


Solution

  • I found this Mach-O file format reference: https://github.com/aidansteele/osx-abi-macho-file-format-reference

    So the answer to my question is that there is a special struct called nlist_64, which contains the address of the function in the executable and the index of the mangled name of that function in the symbol table.