0

This is very confusing and problematic. For example, in a certain executable, the winsock2 library is imported, but only CERTAIN functions from it are listed in the functions tab. However, they are NOT the only functions that are in use. I'm not sure right now, but it may be that the other functions which ARE in use, do not have the _imp_ prefix in the code, while the ones that are listed, do. But I'm really confused because effectively what I end up with is really misleading.

1 Answer 1

3

First, some background. When a binary imports an API function, the operating system loader stores a function pointer to that function in a location specified by metadata in the binary's executable headers. In IDA, on Windows, this section generally is named .idata and is colored pink. You can see a typical example in the following screenshot:

this screenshot

There are two patterns that code in a binary uses to invoke these imported API functions. First, you might see call instructions that reference the function pointers in the aforementioned .idata section directly, as in:

this screenshot

Secondly, for some API functions, the binary might include a so-called "thunk" function, which consists of one single jmp instruction to the imported function pointer.

this screenshot

Now, on to your question. Only imports with associated thunk functions will end up in the functions window. This is natural, because thunk functions are actual functions, whereas function pointers are not functions (they're pointers). If you want to see the collection of functions imported by a given binary, use the Imports window (View->Open subviews->Imports) instead of the Functions window.

4
  • Thanks for the explanation, Rolf! I'd noticed this regularity with only the imported functions having this internal wrapper being listed in the functions tab, but I didn't know the reason. I have a follow-up question: Does this mean the pink functions are dynamically linked while the blue ones are statically linked?
    – swaggg
    Mar 21 at 7:58
  • Teal, rather...
    – swaggg
    Mar 21 at 8:08
  • And by the way, I've never seen a thunk function be referenced from anywhere. Does it actually ever get called in the code?
    – swaggg
    Mar 21 at 9:48
  • 1
    Yes, your understanding of pink (dynamic) vs. teal (static) is correct (assuming IDA has correctly identified a teal library function, and it's not a false positive). As for whether thunk functions are referenced, they should always be referenced, or the linker would normally remove them (though that might not happen if compiling in debug mode). You can see in my third screenshot above that there are two incoming cross-references to the thunk function (see the green text to the right). Mar 21 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.