pe文件运行过程

分析vc6 生成的hello world 程序，

 一、pe入口为 _WinMainCRTStartup （ida6.5显示的函数名，下面是ida7.5转的C代码），简单来说，就是先调用HeapCreate建立一个可变大小的堆，在该堆上申请几块内存用于管理小内存变量，如果是变量较大则调用HeapAlloc。

二、实验

        1、    void* p=HeapCreate(0,4096,0);   

                 void * e=HeapAlloc(p,0,16482);

运行之后，p=0x003f0000,e=0x003f07e0，此时堆应该变大了

        2、   void* p1=HeapCreate(0,4096,0);
                void* p2=HeapCreate(0,4096,0);
                void * e=HeapAlloc(p1,0,16482);

运行之后 p1=0x00560000 p2=0x01f30000 e=0x005607e0

总结：HeapCreate 中预留空间，HeapAlloc申请的空间超范围，则扩大Heap

void __noreturn start()
{
  DWORD v0; // eax
  HMODULE v1; // eax
  int nShowCmd; // [esp+Ch] [ebp-6Ch]
  CHAR *lpCmdLine; // [esp+14h] [ebp-64h]
  int Code; // [esp+18h] [ebp-60h]
  struct _STARTUPINFOA StartupInfo; // [esp+1Ch] [ebp-5Ch] BYREF
  CPPEH_RECORD ms_exc; // [esp+60h] [ebp-18h]

  v0 = GetVersion();
  dword_4236E0 = BYTE1(v0);
  dword_4236DC = (unsigned __int8)v0;
  dword_4236D8 = BYTE1(v0) + ((unsigned __int8)v0 << 8);
  dword_4236D4 = HIWORD(v0);
  if ( !_heap_init(0) )
    fast_error_exit(28);
  ms_exc.registration.TryLevel = 0;
  _ioinit();
  dword_42502C = (int)GetCommandLineA();
  dword_4236B8 = __crtGetEnvironmentStringsA();
  _setargv();
  _setenvp();
  _cinit();
  StartupInfo.dwFlags = 0;
  GetStartupInfoA(&StartupInfo);
  lpCmdLine = (CHAR *)_wincmdln();
  if ( (StartupInfo.dwFlags & 1) != 0 )
    nShowCmd = StartupInfo.wShowWindow;
  else
    nShowCmd = 10;
  v1 = GetModuleHandleA(0);
  Code = WinMain(v1, 0, lpCmdLine, nShowCmd);
  exit(Code);
}