Shulou(Shulou.com)06/03 Report--

Today I finally have time to look at a very large project compiled into an exe and several dll, the program is how to execute its first instruction? What rules does the operating system use to find the first instruction to execute (or how to find the first entry function)?

When we used to write windows console programs, we first wrote a main() function. When writing windows programs, we first wrote winmain() function, and then wrote our own logic; then compile, and then click exe to run our program. And think main or winmain is the first program to run in the program, is also a function that must exist, but a deeper understanding of window programming will find that main or winmain function is not the first function to run, before they will run another function, will initialize global variables and allocate resources, and the release of resources after the end of the program. The program we wrote before is compiled into a module (may be obj file or other form) in the compiler, and then the connector will connect some required library files with the files just generated by the compiler, and finally generate an exe file. The connected library file contains the CRT runtime library, which is the protagonist we are talking about today. In the runtime library there is a function defined as follows:

(1) mainCRTStartup (or wmainCRTStartup)//Applications using/SUBSYSTEM:CONSOLE

(2) WinMainCRTStartup (or wWinMainCRTStartup)//Applications using/SUBSYSTEM:WINDOWS

(3)_DllMainCRTStartup //calls DllMain (if present), DllMain must be defined with__stdcall

Where the function starting with w is unicode version, followed by the delimiter '//' is the subsystem property setting matched by the entry point function.

If the/DLL or/SUBSYSTEM option is not specified, the linker selects subsystems and entry points based on whether main or WinMain is defined. The functions main, WinMain, and DllMain are three user-defined entry point forms.

By default, if your program uses the main() or_main() function, this connector will connect the function in (1) to your exe; if your function starts with the WinWain () function, the connector will connect the function in (2) to your exe; if we are writing a DLL program, the connector will connect the function in (3) to your DLL.

When the exe generated by the program we wrote is executed, one of the above functions is executed at the beginning, not the main or WinMain written by our program. So why do connectors do this? This is because we write programs that have to use various runtime library functions to work properly, so we have to have all the libraries we need before executing our own programs. Oh, see, the reason why we connect them is because they have a very important mission, which is to initialize the runtime libraries and prepare our programs for execution. So what exactly do these functions do? We know from MSDN that---they go further and call other functions, causing C/C++ runtime library code to call constructors and destructors on static nonlocal variables.

There is a Win32 executable file MyApp.exe, which is a Win32 application that conforms to the standard PE format. MyApp.exe's main execution code is concentrated in its source file MyApp.cpp, where the first function executed is WinMain. Beginners may think that the program starts with this WinMain function, but it doesn't.

Before the WinMain function is executed, there is a complex sequence of loading actions and a large chunk of startup code. When MyApp.exe is run, the operating system loader first allocates a 4GB virtual address space for the process, and then maps the disk space occupied by MyApp.exe into this 4GB virtual address space as virtual memory. In general, it maps to the location 0X00400000 in the virtual address space. It takes less time to load an application than most people think, because loading a PE file does not read the file from disk to memory in one go, but simply does a memory map, mapping a large file and mapping a small file takes almost the same time. Of course, when the code in the file is actually executed, the operating system still has to swap the code that exists in virtual memory on disk into physical memory (RAM). However, this swap does not swap the entire virtual address space occupied by the entire file from disk to physical memory at once. The operating system will swap one or more pages according to the need and memory consumption. Of course, this swap is bidirectional, meaning that a portion of the currently unused pages that exist in physical memory may also be swapped to disk. The system then creates process objects and main thread objects in the kernel, among other things. The operating system loader then searches the import tables in the PE file to load the dynamic link libraries used by all applications. Loading a dynamic link library is exactly like loading an application. Then, the operating system executes the code at the address specified in the PE file header to begin execution of the main thread of the application. The first code executed is not the WinMain function in MyApp, but the WinMainCRTStartup function called C Runtime startup code, which is attached to the file MyApp.exe by the linker at connection time. This function gets all the command-line pointers and environment variables for the new process, and initializes some C runtime global variables and C runtime memory allocation functions. If you are programming in C++, you will also execute constructors for global class objects. Finally, the WinMainCRTStartup function calls the WinMain function.

The four parameters passed to WinMain function by WinMainCRTStartup function are hInstance, hPrevInstance, lpCmdline and nCmdShow.

hInstance: Handle to the current instance of the application to which the process corresponds. The WinMainCRTStartup function obtains the value of this parameter by calling the GetStartupInfo function. This parameter is actually the address at which the application is loaded into the process virtual address space, and is usually 0X00400000 for most processes. hPrevInstance: Handle to the previous instance of the application. Because each instance of a Win32 application always runs in its own separate process address space, the WinMainCRTStartup function always passes NULL to this parameter for Win32 applications. If an application wants to know if another instance is running, it can use thread synchronization to create a mutex with a unique name, and by detecting whether this mutex exists, it can know if another instance is running. lpCmdline: Pointer to command line arguments. The pointer points to a string ending in 0 that does not include the application name. nCmdShow: Specifies how application windows are displayed. If the program is run by double-clicking the icon in Explorer, the WinMainCRTStartup function passes SW_SHOWNORMAL to this parameter. If run by calling the CreatProcess function in another application, this parameter is specified by the parameter lpStartupInfo(STARTUPINFO.wShowWindow) of the CreatProcess function.

After the operating system loads the application, initialization is done and execution proceeds to the entry point of the program. The default entry point of the program is set by the linker program, and the entry function selected by different connectors is also different. In VC++, the entry function of the connector to the console program setting is mainCRTStartup, mainCRTStartup then calls the main function; the entry function to the graphical user interface (GUI) program setting is WinMainCRTStartup, WinMainCRTStartup calls the WinMain function written by you. Exactly which entry point is set is determined by the connector's "/subsystem:" option, which tells the operating system how to run the compiled.EXE file. Four ways can be specified: CONSOLE| WINDOWS| NATIVE| POSIX。If the value of this option parameter is WINDOWS, it means that the application does not require a console to run. Refer to the MSDN Library for a detailed description of connector parameter options.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.