分析vc6 生成的hello world 程序,
一、pe入口为 _WinMainCRTStartup (ida6.5显示的函数名,下面是ida7.5转的C代码),简单来说,就是先调用HeapCreate建立一个可变大小的堆,在该堆上申请几块内存用于管理小内存变量,如果是变量较大则调用HeapAlloc。
二、实验
1、 void* p=HeapCreate(0,4096,0);
void * e=HeapAlloc(p,0,16482);
运行之后,p=0x003f0000,e=0x003f07e0,此时堆应该变大了
2、 void* p1=HeapCreate(0,4096,0);
void* p2=HeapCreate(0,4096,0);
void * e=HeapAlloc(p1,0,16482);
运行之后 p1=0x00560000 p2=0x01f30000 e=0x005607e0
总结:HeapCreate 中预留空间,HeapAlloc申请的空间超范围,则扩大Heap
void __noreturn start()
{
DWORD v0; // eax
HMODULE v1; // eax
int nShowCmd; // [esp+Ch] [ebp-6Ch]
CHAR *lpCmdLine; // [esp+14h] [ebp-64h]
int Code; // [esp+18h] [ebp-60h]
struct _STARTUPINFOA StartupInfo; // [esp+1Ch] [ebp-5Ch] BYREF
CPPEH_RECORD ms_exc; // [esp+60h] [ebp-18h]
v0 = GetVersion();
dword_4236E0 = BYTE1(v0);
dword_4236DC = (unsigned __int8)v0;
dword_4236D8 = BYTE1(v0) + ((unsigned __int8)v0 << 8);
dword_4236D4 = HIWORD(v0);
if ( !_heap_init(0) )
fast_error_exit(28);
ms_exc.registration.TryLevel = 0;
_ioinit();
dword_42502C = (int)GetCommandLineA();
dword_4236B8 = __crtGetEnvironmentStringsA();
_setargv();
_setenvp();
_cinit();
StartupInfo.dwFlags = 0;
GetStartupInfoA(&StartupInfo);
lpCmdLine = (CHAR *)_wincmdln();
if ( (StartupInfo.dwFlags & 1) != 0 )
nShowCmd = StartupInfo.wShowWindow;
else
nShowCmd = 10;
v1 = GetModuleHandleA(0);
Code = WinMain(v1, 0, lpCmdLine, nShowCmd);
exit(Code);
}