This is very confusing and problematic. For example, in a certain executable, the winsock2 library is imported, but only CERTAIN functions from it are listed in the functions tab. However, they are NOT the only functions that are in use. I'm not sure right now, but it may be that the other functions which ARE in use, do not have the _imp_ prefix in the code, while the ones that are listed, do. But I'm really confused because effectively what I end up with is really misleading.
1 Answer
First, some background. When a binary imports an API function, the operating system loader stores a function pointer to that function in a location specified by metadata in the binary's executable headers. In IDA, on Windows, this section generally is named .idata and is colored pink. You can see a typical example in the following screenshot:
There are two patterns that code in a binary uses to invoke these imported API functions. First, you might see call instructions that reference the function pointers in the aforementioned .idata section directly, as in:
Secondly, for some API functions, the binary might include a so-called "thunk" function, which consists of one single jmp instruction to the imported function pointer.
Now, on to your question. Only imports with associated thunk functions will end up in the functions window. This is natural, because thunk functions are actual functions, whereas function pointers are not functions (they're pointers). If you want to see the collection of functions imported by a given binary, use the Imports window (View->Open subviews->Imports) instead of the Functions window.
answered Mar 19, 2022 at 19:11
-
Thanks for the explanation, Rolf! I'd noticed this regularity with only the imported functions having this internal wrapper being listed in the functions tab, but I didn't know the reason. I have a follow-up question: Does this mean the pink functions are dynamically linked while the blue ones are statically linked?– swagggMar 21, 2022 at 7:58
-
-
And by the way, I've never seen a thunk function be referenced from anywhere. Does it actually ever get called in the code?– swagggMar 21, 2022 at 9:48
-
1Yes, your understanding of pink (dynamic) vs. teal (static) is correct (assuming IDA has correctly identified a teal library function, and it's not a false positive). As for whether thunk functions are referenced, they should always be referenced, or the linker would normally remove them (though that might not happen if compiling in debug mode). You can see in my third screenshot above that there are two incoming cross-references to the thunk function (see the green text to the right). Mar 21, 2022 at 19:44