When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
Add a comment
|
1 Answer
Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well
nullsub_X
IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types of functions.
One such case is nullsub, which is a name automatically given (during the analysis phase) to all empty functions. Meaning functions that simply return without doing anything.
Additionally, since names are unique in IDA, when an in-use name is set to a function IDA will postfix it with an underscore and then an auto-incremented number (starting with 1).
If you're wondering why such functions should exist in the first place, this post answers that question quite diligently.
___cxa_pure_virtual
This is a function implemented by libstdc++ (and a similar function is implemented by other C++ standard libraries) as a place-holder to pure virtual functions in virtual function tables.
Although pure virtual functions have no implementation the compiler cannot eliminate the risk of pure virtual functions being called at run-time, and so a stub such as ___cxa_pure_virtual is used as a place-holder for all pure virtual functions, so that if it ever happens that a pure virtual function would be called at runtime, there an explicit handling (termination of the program with a somewhat meaningful crash, often).