I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I will locate a specific import, such as WSAStartup, inside of the .idata section of the PE file pictured here:
Upon hitting the
Ctrl-x keys to cross-reference where this function is called, it is only "called" in one spot recognized by IDA, which looks like this:
The question here is, what is the above-pictured structure/technique? It directly contrasts the "typical" setup that I come across which is simply going to .idata, cross-referencing a function, and having it show me areas directly called in code. There are also no direct references to the memory addresses in which each of these jumps reside, such as 14658844h.
I'm going to add one more figure here of a different file but similar sighting, in which case, this instance appears on the control-flow graph and is very obvious by the "orphaned" jmps you can see just above the red arrow:
My hypothesis here is that somehow these memory addresses (function ptrs) pictured in Figure 2 where the jumps reside, are somehow indirectly referenced in the code using some offsets to help mask the usage of these API functions. Is this a compiler feature or is this a manual doing?