3

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.

But what does nullsub_XXX mean in a vtable structure?

1 Answer 1

6

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well

nullsub_X

IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types of functions.

One such case is nullsub, which is a name automatically given (during the analysis phase) to all empty functions. Meaning functions that simply return without doing anything.

Additionally, since names are unique in IDA, when an in-use name is set to a function IDA will postfix it with an underscore and then an auto-incremented number (starting with 1).

If you're wondering why such functions should exist in the first place, this post answers that question quite diligently.

___cxa_pure_virtual

This is a function implemented by libstdc++ (and a similar function is implemented by other C++ standard libraries) as a place-holder to pure virtual functions in virtual function tables.

Although pure virtual functions have no implementation the compiler cannot eliminate the risk of pure virtual functions being called at run-time, and so a stub such as ___cxa_pure_virtual is used as a place-holder for all pure virtual functions, so that if it ever happens that a pure virtual function would be called at runtime, there an explicit handling (termination of the program with a somewhat meaningful crash, often).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.