MSVC Linker
ok after msvc compiler generate pe/coff .obj file msvc call link.exe to handle merge obj to generate one exe file that can run. i skip how link resolve relocation and other think relate to obj because already in my previous page. now take analysis linker from .map file that generate by linker to report to use:
now we get how msvc link objects to one executable file, first take a look at merge group in text section:
Get root user’s stories in your inbox
Join Medium for free to get updates from this writer.
before main function linker inject many code relate to security,relocation,seh,initalization,etc after main function linker now put user function follow with other inject code addresswith 00000000 generally before EP:
execute genrally not sequent before main function function or code can execute code after main it can be initailize,global initalize,security,tls,etc. let step to next analysis the first image i have put in:
“text$di” is dynamic initalize code
“text$mn” is main function
“idata$5” is import address table
“idata$2” is import directory table
“idata$3” is dll name string
“idata$4” is image lookup table
“idata$6” is name table
“gfid$y” guard function
“rdata” read data genrally for global data
“edata” export table
“xdata” exception table
“rtc” run time check
“crt$x” c run time U group for global initalization/crt$xcu:
for complete crt$x can check in vcruntime code in visual studo, let analysis important section:
“text$mn” main function have offset 03df8 after 0x50 from previos section
“idata$5” iat have 0x138 size from beginning of rdata
“crt$xcu” have 0x14 size with pointer inside, here crt$xca is 0 and crt$xcz is 0
“rdata” global data self start from 0x1a0
………….
