Reverse Engineering for Beginners

(avery) #1

CHAPTER 68. WINDOWS NT CHAPTER 68. WINDOWS NT
93 mov dword_40AC80, eax
94 push eax ; envp
95 push argv ; argv
96 push argc ; argc
97 call _main
98 add esp, 0Ch
99 mov [ebp+var_20], eax
100 cmp [ebp+var_1C], 0
101 jnz short $LN28
102 push eax ; uExitCode
103 call $LN32
104
105 $LN28: ; CODE XREF: _tmainCRTStartup+105
106 call __cexit
107 jmp short loc_401186
108
109
110 $LN27: ; DATA XREF: .rdata:stru_4092D0
111 mov eax, [ebp+ms_exc.exc_ptr] ; Exception filter 0 for function 401044
112 mov ecx, [eax]
113 mov ecx, [ecx]
114 mov [ebp+var_24], ecx
115 push eax
116 push ecx
117 call
XcptFilter
118 pop ecx
119 pop ecx
120
121 $LN24:
122 retn
123
124
125 $LN14: ; DATA XREF: .rdata:stru_4092D0
126 mov esp, [ebp+ms_exc.old_esp] ; Exception handler 0 for function 401044
127 mov eax, [ebp+var_24]
128 mov [ebp+var_20], eax
129 cmp [ebp+var_1C], 0
130 jnz short $LN29
131 push eax ; int
132 call exit
133
134
135 $LN29: ; CODE XREF: _tmainCRTStartup+135
136 call
c_exit
137
138 loc401186: ; CODE XREF:
tmainCRTStartup+112
139 mov [ebp+ms_exc.disabled], 0FFFFFFFEh
140 mov eax, [ebp+var_20]
141 call __SEH_epilog4
142 retn


Here we can see calls toGetCommandLineA()(line 62), then tosetargv()(line 66) andsetenvp()(line 74), which
apparently fill the global variablesargc,argv,envp.

Finally,main()is called with these arguments (line 97).

There are also calls to functions with self-describing names likeheap_init()(line 35),ioinit()(line 54).

Theheapis indeed initialized in theCRT. If you try to usemalloc()in a program without CRT, it will exit abnormally with
the following error:

runtime error R6030


  • CRT not initialized


Global object initializations in C++ is also occur in theCRTbefore the execution ofmain():51.4.1 on page 543.

The value thatmain()returns is passed tocexit(), or in$LN32, which in turn callsdoexit().

Is it possible to get rid of theCRT? Yes, if you know what you are doing.

TheMSVC’s linker has the/ENTRYoption for setting an entry point.
Free download pdf