I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls four callee functions, two global functions and two public function of a class. But, in ida, it has more than ten callees, if I print the line.points.size(). It is recognized as a function in ida. line is my class, points is a vector variable of line. The function in ida is named std::vector<std::vector<Point *,std::allocator<Point *>>,std::allocator<std::vector<Point *,std::allocator<Point *>>>>::size(void). So it caused that the number of callee is not equal to the number in source. Why are there so much more functions that are not defined as function in my source? How can I recognize which function in ida is the function I define and which one is added by ida?
-
this question is not about 'C' so the 'c' tag should be removed– user3629249Jan 3, 2019 at 17:58
-
C programs are also my analysis targets. I don not know whether it is about c/c++ compilation rules. So, I add c tag.– greagenJan 5, 2019 at 2:58
-
The posted code is using C++ templates, so the code, you posted, is not about 'c'– user3629249Jan 5, 2019 at 3:20
2 Answers
You just discovered why templates are accused of code bloat.
That function is not added by IDA but instead by the compiler when it expanded the templated class std::vector<std::vector<Point*>> and generated all its member functions. Every std::vector with a different template parameter is considered a separate type. So std::vector<int>::size() and std::vector<float>::size() are separate functions however a sufficiently smart compiler/linker with high enough optimization settings will see that the code of the two is the exact same and be able to combine them.
-
Thanks，you helped me solve the first problem, as for the second one, can I distinguish the functions that I defined in my code without function name? I mean that if the binary is stripped, its symbols are not availble, When given the dissasemble functions in ida, is there any difference between functions I defined and that expanded by compiler? For example, some tags?property？ so that I can find my own functions.– greagenJan 3, 2019 at 5:34
A compiler has to translate the language that you know (C++) to the language that the computer knows. A linker then links together your code with referenced libraries and creates an executable. In order to turn it back into a form that you can read, IDA reads the computer's language and translates it into a disassembly. Both compilation and disassembly are complicated processes. Disassembly itself is a hard problem, including function identification and boundary detection. In addition to inaccuracies in the disassembly process, the executable building process does several things.
First, your source code is translated into machine code, and all modern compilers have various heuristics and rules they use to optimize the code. Take a look at the docs for gcc and the docs for Visual Studio. Sometimes this means decreasing the number of functions (for example, inlining), and sometimes it means increasing (for example, thunks).
Second, either implicitly or explicitly, your source code is referencing lots of other source code, with includes, and includes within those included files, and includes within those included files... some of which cause the linker to dynamically link (add references to) libraries, and some of which cause the linker to statically link (copy and append to your code) those libraries.
