First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where there is a list of places where the function is called/branched to). I assume that these functions are virtual functions, and that the reference is in the vtable.
However, I expect that a reference to the function should still be found in the vtable data, and I should be able to see where the function is called by looking for read accesses on the vtable field. But Ghidra does not show any reference to the function from anything that looks like a vtable.
The only references that Ghidra finds to these functions are a bunch of places called "frame descriptor entry" and "LSDA call site record", which I understand are to do with exception handling?
This is seriously frustrating. I'll be working on a function and then follow the path up through all the functions that call it in order to find where some particular operation is being performed, and then suddenly reach a dead end at one of these functions that apparently isn't called anywhere.
I'm aware that Ghidra doesn't have particularly good support for C++, but the vtable still exists and the data for it has to be in memory somewhere so Ghidra should still be able to find it right? As it is I don't even know where the vtables are.
EDIT: Is it normal for these references to not show up? If so, how does one go about finding the vtables and determining which functions they point to, or determining which vtables point to a given function? I don't know what I should expect to be seeing, and the only examples that I can find are trivial examples with only one or two classes and with various kinds of type information available and automatically filled in, rather than a real-world example with lots of FUN_012345678 labels and undefined parameters and stripped and optimised object code.
