flat assembler
Message board for the users of flat assembler.
Index
> High Level Languages > [PE/ELF???] what is .ctor section? |
Author |
|
revolution 21 Jun 2014, 04:37
Are you asking about the section name in a PE file? It could be anything since it is only a name but most probably it would be the "constructor" section from an HLL compiler.
Perhaps this should be in the HLL forum? |
|||
21 Jun 2014, 04:37 |
|
Bargest 21 Jun 2014, 10:20
If you mean ELF-section - yes, these functions are called as "constructors" at the program start.
If you've found this section in PE file - it can be anything, depending on compiler used. But if it is called ".ctor" and it is not a result of some kind obfuscation, it should be really a set of constructors. But I haven't seen such sections in PE files. |
|||
21 Jun 2014, 10:20 |
|
DOS386 23 Jun 2014, 14:31
PE loader doesn't evaluate the section names. They may give a hint about compiler, linker, EXE-packer etc. Or they may contain deliberately wrong stuff to confuse the enemy (for example "aspack" despite some other packer was used).
|
|||
23 Jun 2014, 14:31 |
|
tthsqe 24 Jun 2014, 03:53
Thanks for the responses. It is a mingw generated .o file from a .cpp source. I have since given up on trying to analyse the .exe file produced by the compiler. It seems that .cpp really makes a mess of things. Is there any place that documents all of the extra s**t that the compiler puts into the .exe? The function name I gave above was listed in the .ctors section of the .o file but it seems that it resided in the .text section of the .exe and is called at prog start from a list of about 18 functions.
|
|||
24 Jun 2014, 03:53 |
|
alexfru 24 Jun 2014, 05:40
The compiler links the object files generated from your program's source code to the standard library and to the startup code that gets executed before main() (in case of C/C++). That startup code may perform a bunch of initializations specific to the standard library, to the language and to the actual implementation of it all. For example, C++ static objects must be created/initialized before main(), hence some constructors must be called. The .ctor section contains information directing the process (e.g. it can contain a list of addresses of subroutines that do the construction/initialization work and the startup code simply iterates it and calls every subroutine from this list). All of this is compiler-specific and you should be reading the documentation specific to your compiler. The ELF and PE and most other formats are by no means limited to C/C++, they are language and compiler agnostic for the most part. Unfortunately, it seems like this section stuff is ever-changing and isn't properly documented all in one place. But not everyone needs it.
http://www.delorie.com/gnu/docs/gcc/gccint_149.html (what I said about .ctor being a list) |
|||
24 Jun 2014, 05:40 |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.