Add MSVC Symbol Demangling Support for PE Binaries

[unclesp1d3r]

Summary

Extend the SymbolDemangler to handle MSVC-mangled symbols (?-prefixed) found in Windows PE binaries. The core Rust and C++ Itanium ABI demangling is already fully implemented; this issue tracks the remaining gap for Windows-native symbols.

Current State

The SymbolDemangler in src/classification/symbols.rs already handles:

• ✅ Rust legacy mangling (_ZN prefix) via rustc-demangle = "0.1.27"
• ✅ Rust v0 mangling (_R prefix) via rustc-demangle
• ✅ C++ Itanium ABI (_Z prefix) via cpp_demangle = "0.5.1"
• ✅ Pipeline integration in classify_strings() within src/pipeline/mod.rs
• ✅ Graceful fallback — failed demanglings are tracked and warned

The Gap

The pipeline in src/pipeline/mod.rs already detects MSVC-mangled symbols via:

let looks_mangled =
    s.text.starts_with("_Z") || s.text.starts_with("_R") || s.text.starts_with('?');

However, SymbolDemangler::is_mangled() and SymbolDemangler::demangle() have no handling for ?-prefixed MSVC symbols. The pipeline detects them but SymbolDemangler silently passes through — producing no demangled output for any Windows PE import/export symbol using MSVC mangling.

MSVC-mangled symbol example:

• Mangled: ?printf@@YAHPEBDZZ
• Expected demangled: int __cdecl printf(char const * const,...)

This is a high-value gap because Stringy targets PE binary analysis (src/container/pe/) and MSVC is the dominant toolchain for Windows binaries.

Proposed Solution

1. Add Dependency

Add an MSVC demangling crate to Cargo.toml, for example msvc-demangler:

msvc-demangler = "0.10"

2. Extend SymbolDemangler

// In src/classification/symbols.rs

pub fn is_mangled(&self, symbol: &str) -> bool {
    symbol.starts_with("_R")   // Rust v0
        || symbol.starts_with("_Z") // Itanium ABI (Rust legacy + C++)
        || symbol.starts_with('?')   // MSVC
}

fn try_demangle_internal(&self, symbol: &str) -> Option<String> {
    if symbol.starts_with("_R") {
        return self.try_rust_demangle(symbol);
    }
    if symbol.starts_with("_Z") {
        return self.try_rust_demangle(symbol)
            .or_else(|| self.try_cpp_demangle(symbol));
    }
    if symbol.starts_with('?') {
        return self.try_msvc_demangle(symbol);
    }
    None
}

fn try_msvc_demangle(&self, symbol: &str) -> Option<String> {
    // Use msvc-demangler crate
    let demangled = msvc_demangler::demangle(symbol, msvc_demangler::DemangleFlags::llvm()).ok()?;
    if demangled != symbol {
        Some(demangled)
    } else {
        None
    }
}

3. Tests Required

Add comprehensive tests to src/classification/symbols.rs:

• is_mangled correctly returns true for ?-prefixed symbols
• demangle produces correct output for common MSVC patterns (plain functions, namespaced methods, overloaded operators)
• Fallback to original on invalid/unknown MSVC-mangled input
• No regression on existing Rust and C++ demangling tests

Add integration tests using real PE binary fixtures (if available under tests/fixtures/).

Acceptance Criteria

• SymbolDemangler::is_mangled() returns true for ?-prefixed symbols
• SymbolDemangler::demangle() correctly demangled MSVC symbols into human-readable form
• Demangled MSVC symbols receive Tag::DemangledSymbol and preserve original in original_text
• Unit tests cover: valid MSVC symbols, invalid input fallback, operator overloads, templates
• No regression in existing Rust/C++ demangling tests
• cargo deny check passes with the new dependency
• Performance overhead measured and acceptable

Requirements

Requirement ID: 4.1

Task ID

stringy-analyzer/symbol-processing

Related Work

• src/classification/symbols.rs — extend SymbolDemangler
• src/pipeline/mod.rs — classify_strings() already detects ? prefix; no pipeline changes needed
• src/container/pe/ — primary consumer of MSVC-demangled symbols

[unclesp1d3r]

@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the current issue details
gh issue view 19 --json title,body,labels,assignees,state,author,createdAt,updatedAt

Length of output: 1193

---

🏁 Script executed:

#!/bin/bash
# Check available labels in the repository to see what other labels we could apply
gh label list --limit 100

echo "---"
echo "Checking if there are milestones"
gh milestone list

Length of output: 1041

---

🏁 Script executed:

#!/bin/bash
# Update the issue with enhanced title and body

gh issue edit 19 \
  --title "Implement Rust Symbol Demangling Support" \
  --body "## Summary

Implement Rust symbol demangling functionality to decode mangled Rust symbols into human-readable format. This enhancement will improve the analyzer's ability to process and display Rust binary symbols.

## Background

Rust uses name mangling to encode additional information (such as type parameters, namespaces, and trait implementations) into symbol names. Mangled Rust symbols are difficult to read and understand without proper demangling. For example:
- Mangled: \`_ZN3std2io5stdio6_print17h0123456789abcdefE\`
- Demangled: \`std::io::stdio::_print\`

Supporting Rust symbol demangling will enable StringyMcStringFace to:
- Display readable function and method names from Rust binaries
- Improve string classification accuracy for Rust-compiled artifacts
- Provide better analysis output for users working with Rust code

## Proposed Solution

### Implementation Steps

1. **Add Dependencies**
   - Add \`rustc-demangle\` crate to \`Cargo.toml\`
   - Version: Use latest stable (^0.1)

2. **Create Symbol Processing Module**
   - Create new file: \`src/classification/symbols.rs\`
   - Implement \`demangle_rust_symbol()\` function
   - Handle both legacy and v0 Rust mangling schemes
   - Return original string if demangling fails (graceful fallback)

3. **Integration Points**
   - Integrate symbol demangling into the string classification pipeline
   - Apply demangling during binary analysis phase
   - Ensure demangling is optional/configurable

4. **Error Handling**
   - Handle invalid symbol formats gracefully
   - Log demangling failures for debugging
   - Maintain performance with large symbol tables

### Code Structure

\`\`\`rust
// src/classification/symbols.rs
use rustc_demangle::demangle;

pub fn demangle_rust_symbol(mangled: &str) -> String {
    // Attempt to demangle, fallback to original on failure
    demangle(mangled).to_string()
}

pub fn is_rust_symbol(symbol: &str) -> bool {
    // Check if symbol matches Rust mangling pattern
    symbol.starts_with(\"_ZN\") || symbol.starts_with(\"_R\")
}
\`\`\`

## Testing Strategy

Implement comprehensive unit tests covering:

1. **Valid Rust Symbols**
   - Standard function names
   - Methods with type parameters
   - Trait implementations
   - Nested modules

2. **Edge Cases**
   - Empty strings
   - Non-Rust mangled symbols (C++, D, etc.)
   - Partially mangled strings
   - Very long symbol names

3. **Performance Tests**
   - Benchmark demangling with large symbol tables
   - Ensure acceptable performance overhead

### Example Test Cases

\`\`\`rust
#[test]
fn test_demangle_rust_symbol() {
    assert_eq!(
        demangle_rust_symbol(\"_ZN3std2io5stdio6_print17h0123456789abcdefE\"),
        \"std::io::stdio::_print\"
    );
}

#[test]
fn test_invalid_symbol_returns_original() {
    let invalid = \"not_a_mangled_symbol\";
    assert_eq!(demangle_rust_symbol(invalid), invalid);
}
\`\`\`

## Acceptance Criteria

- [ ] \`rustc-demangle\` dependency added to Cargo.toml
- [ ] \`src/classification/symbols.rs\` module created with demangling functionality
- [ ] Unit tests achieve >90% code coverage
- [ ] All tests pass successfully
- [ ] Documentation added for public APIs
- [ ] Performance impact measured and acceptable (<5% overhead)

## Requirements

Requirement ID: 4.1

## Task ID

stringy-analyzer/symbol-processing

## Related Work

- Consider future support for other languages (C++, D, Swift)
- Potential integration with existing classification rules
- May need configuration option to enable/disable demangling"

echo "Issue updated successfully!"

Length of output: 90

---

@unclesp1d3r I've successfully enhanced issue #19 with the following improvements:

Changes Made

✅ Title Updated: Changed from "Symbol Processing" to "Implement Rust Symbol Demangling Support" - much more specific and descriptive

✅ Enhanced Issue Body with:

• Background section explaining why Rust symbol demangling is important, with concrete examples of mangled vs. demangled symbols
• Detailed Proposed Solution including:
  • Step-by-step implementation plan
  • Specific dependency versions
  • Code structure examples
  • Integration points and error handling considerations
• Comprehensive Testing Strategy covering valid symbols, edge cases, and performance tests with example test code
• Clear Acceptance Criteria with checkboxes for tracking progress
• Related Work section for future considerations

✅ Metadata Preserved:

• Kept all existing labels (area:analyzer, type:enhancement, status:backlog, lang:rust, needs:tests) - they're already well-chosen
• Maintained assignment to you
• Preserved requirement 4.1 and task ID references

The issue now provides clear context for why this feature is needed, how it should be implemented, and what success looks like. Anyone picking up this task will have all the information they need to get started! 🎯