What is "nullsub_XXX" in vtable in IDA

Question

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.

But what does nullsub_XXX mean in a vtable structure?

Answer 1

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well

nullsub_X

IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types of functions.

One such case is nullsub, which is a name automatically given (during the analysis phase) to all empty functions. Meaning functions that simply return without doing anything.

Additionally, since names are unique in IDA, when an in-use name is set to a function IDA will postfix it with an underscore and then an auto-incremented number (starting with 1).

If you're wondering why such functions should exist in the first place, this post answers that question quite diligently.

___cxa_pure_virtual

This is a function implemented by libstdc++ (and a similar function is implemented by other C++ standard libraries) as a place-holder to pure virtual functions in virtual function tables.

Although pure virtual functions have no implementation the compiler cannot eliminate the risk of pure virtual functions being called at run-time, and so a stub such as ___cxa_pure_virtual is used as a place-holder for all pure virtual functions, so that if it ever happens that a pure virtual function would be called at runtime, there an explicit handling (termination of the program with a somewhat meaningful crash, often).