flat assembler
Message board for the users of flat assembler.

Index > High Level Languages > [PE/ELF???] what is .ctor section?

Author
Thread Post new topic Reply to topic
tthsqe



Joined: 20 May 2009
Posts: 767
tthsqe 21 Jun 2014, 04:12
What is the .ctor section? should the functions in this section be called before the rest of the program starts?
The compiler is giving these names such as
Code:
_GLOBAL__sub_I__ZTv0_n24_N3LogD1Ev    


Sry revolution, and thanks for the answer. You can move it to the HLL section if you have time.


Last edited by tthsqe on 21 Jun 2014, 04:42; edited 1 time in total
Post 21 Jun 2014, 04:12
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system
revolution 21 Jun 2014, 04:37
Are you asking about the section name in a PE file? It could be anything since it is only a name but most probably it would be the "constructor" section from an HLL compiler.

Perhaps this should be in the HLL forum?
Post 21 Jun 2014, 04:37
View user's profile Send private message Visit poster's website Reply with quote
Bargest



Joined: 09 Feb 2012
Posts: 79
Location: Russia
Bargest 21 Jun 2014, 10:20
If you mean ELF-section - yes, these functions are called as "constructors" at the program start.
If you've found this section in PE file - it can be anything, depending on compiler used. But if it is called ".ctor" and it is not a result of some kind obfuscation, it should be really a set of constructors. But I haven't seen such sections in PE files.
Post 21 Jun 2014, 10:20
View user's profile Send private message Reply with quote
DOS386



Joined: 08 Dec 2006
Posts: 1900
DOS386 23 Jun 2014, 14:31
PE loader doesn't evaluate the section names. They may give a hint about compiler, linker, EXE-packer etc. Or they may contain deliberately wrong stuff to confuse the enemy (for example "aspack" despite some other packer was used).
Post 23 Jun 2014, 14:31
View user's profile Send private message Reply with quote
tthsqe



Joined: 20 May 2009
Posts: 767
tthsqe 24 Jun 2014, 03:53
Thanks for the responses. It is a mingw generated .o file from a .cpp source. I have since given up on trying to analyse the .exe file produced by the compiler. It seems that .cpp really makes a mess of things. Is there any place that documents all of the extra s**t that the compiler puts into the .exe? The function name I gave above was listed in the .ctors section of the .o file but it seems that it resided in the .text section of the .exe and is called at prog start from a list of about 18 functions.
Post 24 Jun 2014, 03:53
View user's profile Send private message Reply with quote
alexfru



Joined: 23 Mar 2014
Posts: 80
alexfru 24 Jun 2014, 05:40
The compiler links the object files generated from your program's source code to the standard library and to the startup code that gets executed before main() (in case of C/C++). That startup code may perform a bunch of initializations specific to the standard library, to the language and to the actual implementation of it all. For example, C++ static objects must be created/initialized before main(), hence some constructors must be called. The .ctor section contains information directing the process (e.g. it can contain a list of addresses of subroutines that do the construction/initialization work and the startup code simply iterates it and calls every subroutine from this list). All of this is compiler-specific and you should be reading the documentation specific to your compiler. The ELF and PE and most other formats are by no means limited to C/C++, they are language and compiler agnostic for the most part. Unfortunately, it seems like this section stuff is ever-changing and isn't properly documented all in one place. But not everyone needs it.

http://www.delorie.com/gnu/docs/gcc/gccint_149.html (what I said about .ctor being a list)
Post 24 Jun 2014, 05:40
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.