GCC 2.95.3 name mangling grammar (intuited from gcc sources):
------------------------------------------------------------
<global-function> ::= <name> '__F' <func-params>
<member-function> ::= <name> '__' <class-name> <func-params>
<ctor-function> ::= '__' <class-name> <func-params>
<dtor-function> ::= '_' <joiner> '_' <class-name> <func-params>
<joiner> ::= '.' | '$' # system-dependent joiner
<class-name> ::= <qualified-name>
<qualified-name> ::= <component>
::= 'Q' <digit> <component>+
::= 'Q' '_' <digit>+ '_' <component>+
<component> ::= <digit>+ <identifier> # length-prefixed name
<overload-item> ::= 'R' <type> # reference
::= 'P' <type> # array or pointer type
::= 'O' <type> '_' <type> # offset type
::= 'M' <type> <modifiers> <function-type> # methods
::= <function-type>
::= <builtin-type>
::= <qualified-name>
<type> ::= <modifiers> <overload-item>
<function-type> ::= 'F' <func-params> '_' <return-type>
<func-params> ::= 'e' # () parameters
::= 'v' # (void) parameters
::= <parameter>+
::= <parameter>+ 'e' # ends in "..."
<return-type> ::= <type>
<modifiers> ::= [C] [U] [V] [u] # const, unsigned, volatile, restrict
<builtin-type> ::= 'i' # int
::= 'l' # long
::= 's' # short
::= 'Sc' # signed char
::= 'c' # char
::= 'w' # wchar/java-char
::= 'x' # long long
::= 'b' # bool
::= 'r' # long double
::= 'd' # double
::= 'f' # float
::= 'J' <type> # complex <type>
::= 'v' # void
::= 'I' <bit-size> # integer of <bit-size> bits
<bit-size> ::= <hex> <hex> # sizes < 256
::= _ <hex>+ _ # sizes >= 256
<parameter> ::= <type>
::= <repeat-count> <backref>
<repeat-count> ::= 'T' # single repeat
::= 'N' <digit> # repeats of 2..9
::= 'N' <number> '_' # repeats of 10 or more
::= 'n' <digit> # alt-style, repeats of 1..9
::= 'n' <number> '_' # alt-style, repeats of 10+
<backref> ::= <digit> # backrefs 0..9
::= <number> '_' # backrefs of 10 or more
GCC 3.2 name mangling grammar (extracted from gcc sources):
----------------------------------------------------------
<substitution> ::= St
# ::std
::= Sa
# ::std::allocator
::= Sb
# ::std::basic_string
::= Ss
# ::std::basic_string<char,
::std::char_traits<char>,
::std::allocator<char> >
::= Si
# ::std::basic_istream<char, ::std::char_traits<char> >
::= So
# ::std::basic_ostream<char, ::std::char_traits<char> >
::= Sd
# ::std::basic_iostream<char, ::std::char_traits<char> >
::= S <seq-id> _ # base 36 sequence id
::= S_
<mangled-name> ::= _Z <encoding>
<encoding> ::= <function name> <bare-function-type>
::= <data name>
<name> ::= <unscoped-name>
::= <unscoped-template-name> <template-args>
::= <nested-name>
::= <local-name>
If IGNORE_LOCAL_SCOPE option to <name> is non-zero, this production of
<name> is called from <local-name>, which mangles the enclosing scope
elsewhere and then uses this function to mangle just the part
underneath the function scope. So don't use the <local-name>
production, to avoid an infinite recursion.
<unscoped-name> ::= <unqualified-name>
::= St <unqualified-name> # ::std::
<unscoped-template-name> ::= <unscoped-name>
::= <substitution>
<nested-name> ::= N [<CV-qualifiers>] <prefix> <unqualified-name> E
::= N [<CV-qualifiers>] <template-prefix> <template-args> E
<CV-qualifiers> ::= [r] [V] [K]
<prefix> ::= <prefix> <unqualified-name>>
::= <template-prefix> <template-args>
::= # empty
::= <substitution>
<template-prefix> ::= <prefix> <template component>
::= <substitution>
<unqualified-name> ::= <operator-name>
::= <special-name>
::= <source-name>
<source-name> ::= </length/ number> <identifier>
<number> ::= [n] </decimal integer/>
<identifier> ::= </unqualified source code identifier>
<special-name> ::= C1 # complete object constructor
::= C2 # base object constructor
::= C3 # complete object allocating constructor
::= D0 # deleting (in-charge) destructor
::= D1 # complete object (in-charge) destructor
::= D2 # base object (not-in-charge) destructor
::= CT <type> <offset number> _ <base type>
::= Th <offset number> _ <base encoding>
::= Tv <offset number> _ <vcall offset number> _
<base encoding>
<discriminator> := _ <number>
<local-name> := Z <function encoding> E <entity name> [<discriminator>]
:= Z <function encoding> E s [<discriminator>]
<type> ::= <builtin-type>
::= <function-type>
::= <class-enum-type>
::= <array-type>
::= <pointer-to-member-type>
::= <template-param>
::= <substitution>
::= <CV-qualifier>
::= P <type> # pointer-to
::= R <type> # reference-to
::= C <type> # complex pair (C 2000)
::= G <type> # imaginary (C 2000) [not supported]
::= U <source-name> <type> # vendor extended type qualifier
<builtin-type> ::= v # void
::= b # bool
::= w # wchar_t
::= c # char
::= a # signed char
::= h # unsigned char
::= s # short
::= t # unsigned short
::= i # int
::= j # unsigned int
::= l # long
::= m # unsigned long
::= x # long long, __int64
::= y # unsigned long long, __int64
::= n # __int128
::= o # unsigned __int128
::= f # float
::= d # double
::= e # long double, __float80
::= g # __float128 [not supported]
::= u <source-name> # vendor extended type */
<function-type> ::= F [Y] <bare-function-type> E
<bare-function-type> ::= </signature/ type>+
<class-enum-type> ::= <name>
<template-args> ::= I <template-arg>+ E
<expression> ::= <unary operator-name> <expression>
::= <binary operator-name> <expression> <expression>
::= <expr-primary>
<expr-primary> ::= <template-param>
::= L <type> <value number> E # literal
::= L <mangled-name> E # external name
<template-arg> ::= <type> # type
::= L <type> </value/ number> E # literal
::= LZ <name> E # external name
::= X <expression> E # expression
Literal subcase of non-terminal <template-arg>.
"Literal arguments, e.g. "A<42L>", are encoded with their type
and value. Negative integer values are preceded with "n"; for
example, "A<-42L>" becomes "1AILln42EE". The bool value false is
encoded as 0, true as 1. If floating-point arguments are accepted
as an extension, their values should be encoded using a
fixed-length lowercase hexadecimal string corresponding to the
internal representation (IEEE on IA-64), high-order bytes first,
without leading zeroes. For example: "Lfbff000000E" is -1.0f."
<template-template-arg> ::= <name>
::= <substitution>
<array-type> ::= A [</dimension/ number>] _ </element/ type>
::= A <expression> _ </element/ type>
"Array types encode the dimension (number of elements) and the
element type. For variable length arrays, the dimension (but not
the '_' separator) is omitted."
<pointer-to-member-type> ::= M </class/ type> </member/ type>
<template-param> ::= T </parameter/ number> _
<template-template-param> ::= <template-param>
::= <substitution>
MSVC 6.0 name mangling rules (determined by trial and error):
------------------------------------------------------------
<global-function> ::= '?' <name> '@@Y' <callconv> <return-type> <parameters>
<member-function> ::= '?' <name> '@' <class-name> '@@' <access>
[<const>] <callconv> <return-type> <parameters>
<ctor-function> ::= '??0' <class-name> '@@' <access> <const> <callconv>
'@' <parameters>
<dtor-function> ::= '??1' <class-name> '@@' <access> <const> <callconv>
'@' <parameters>
<access> ::= 'Q' # public instance
::= 'I' # protected instance
::= 'A' # private instance
::= 'S' # public static
::= 'K' # protected static
::= 'C' # private static
::= 'U' # public virtual
::= 'M' # protected virtual
::= 'E' # private virtual
<callconv> ::= 'A' # cdecl
::= 'E' # thiscall
::= 'G' # stdcall
::= 'I' # fastcall
<const> ::= 'A' # non-const method (instance only)
::= 'B' # const method (instance only)
<return-type> ::= 'X' # void
::= <type>
<parameters> ::= 'XZ' # () or (void)
::= <type>+ '@Z' # 1 or more parameters
::= <type>+ 'ZZ' # 1 or more, followed by ...
<func-ptr> ::= <callconv> <return-type> <parameters>
<type> ::= <builtin-type>
::= 'PA' <type> # pointer to <type>
::= 'PB' <type> # const pointer to <type>
::= 'PC' <type> # volatile pointer to <type>
::= 'PD' <type> # const volatile pointer to <type>
::= 'P6' <func-ptr> # function pointer type
::= 'AA' <type> # reference to <type>
::= 'AB' <type> # const reference to <type>
::= 'AC' <type> # volatile reference to <type>
::= 'AD' <type> # const volatile reference to <type>
::= 'T' <name> '@@' # union name
::= 'U' <name> '@@' # struct name
::= 'V' <name> '@@' # class name
::= 'W' <digit> <name> '@@' # enum of a given byte size
::= <digit> # backref to identifier 'n' in name
<builtin-type> ::= 'D' # char
::= 'C' # signed char
::= 'E' # unsigned char
::= 'F' # short
::= 'G' # unsigned short
::= 'H' # int
::= 'I' # unsigned int
::= 'J' # long
::= 'K' # unsigned long
::= '_J' # __int64
::= '_K' # unsigned __int64
::= 'M' # float
::= 'N' # double
::= 'O' # long double
<class-name> ::= <name>
::= <identifier> '@' <name>
::= <digit> <name>
# namespaces listed in reverse order
# i.e. "X::Y::Z" becomes "Z@Y@X".
<name> ::= <identifier>
::= <digit> # backref to identifier 'n' in name