It because of the "Link Incrementally".
For example, there is a test program:
#include <iostream>
void test(void)
{
std::cout << "Hello" << std::endl;
return;
}
int main()
{
test();
return 0;
}
If I enable /INCREMENTAL option, the code is:
; __int64 __fastcall main()
main proc near
push rbp
push rdi
sub rsp, 0E8h
lea rbp, [rsp+20h]
lea rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call j___CheckForDebuggerJustMyCode
call j_?test@@YAXXZ ; test(void)
xor eax, eax
lea rsp, [rbp+0C8h]
pop rdi
pop rbp
retn
main endp
; void test(void)
j_?test@@YAXXZ proc near
jmp ?test@@YAXXZ ; test(void)
j_?test@@YAXXZ endp
; void test(void)
?test@@YAXXZ proc near
push rbp
push rdi
sub rsp, 0E8h
lea rbp, [rsp+20h]
lea rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call j___CheckForDebuggerJustMyCode
lea rdx, _Val ; "Hello"
mov rcx, cs:__imp_?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; _Ostr
call j_??$?6U?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@PEBD@Z ; std::operator<<<std::char_traits<char>>(std::ostream &,char const *)
lea rdx, j_??$endl@DU?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@@Z ; std::endl<char,std::char_traits<char>>(std::ostream &)
mov rcx, rax
call cs:__imp_??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ; std::ostream::operator<<(std::ostream & (*)(std::ostream &))
lea rsp, [rbp+0C8h]
pop rdi
pop rbp
retn
?test@@YAXXZ endp
And if I disable the /INCREMENTAL option, the code is:
; __int64 __fastcall main()
main proc near
push rbp
push rdi
sub rsp, 0E8h
lea rbp, [rsp+20h]
lea rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call __CheckForDebuggerJustMyCode
call ?test@@YAXXZ ; test(void)
xor eax, eax
lea rsp, [rbp+0C8h]
pop rdi
pop rbp
retn
main endp
; void test(void)
?test@@YAXXZ proc near
push rbp
push rdi
sub rsp, 0E8h
lea rbp, [rsp+20h]
lea rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call __CheckForDebuggerJustMyCode
lea rdx, _Val ; "Hello"
mov rcx, cs:__imp_?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; _Ostr
call ??$?6U?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@PEBD@Z ; std::operator<<<std::char_traits<char>>(std::ostream &,char const *)
lea rdx, ??$endl@DU?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@@Z ; std::endl<char,std::char_traits<char>>(std::ostream &)
mov rcx, rax
call cs:__imp_??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ; std::ostream::operator<<(std::ostream & (*)(std::ostream &))
lea rsp, [rbp+0C8h]
pop rdi
pop rbp
retn
?test@@YAXXZ endp
More info about the Link Incrementally:
https://docs.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170
call
statement is limited to a certain bit size which is not enough to reach the actual implementation. What architecture is the binary you have loaded in Ida?