It is known that Visual Studio library *.lib file is an Unix "ar" archive containing object modules in COFF format. But I found that libraries for importing DLL is an archive of small chunks (or stubs) that are not COFF objects. An example is the library VS15\lib\ucrt\ucrt.lib. These chunks contain the name of function and the reference to DLL library that defines this function. Here is an example (hex dump) of stub for "puts" function:
00-00-FF-FF-00-00-4C-01-39-E9-80-55-26-00-00-00 ......L.9..U&...
93-00-08-00-5F-70-75-74-73-00-61-70-69-2D-6D-73 “..._puts.api-ms
2D-77-69-6E-2D-63-72-74-2D-73-74-64-69-6F-2D-6C -win-crt-stdio-l
31-2D-31-2D-30-2E-64-6C-6C-00 1-1-0.dll.
It is definitely not COFF object (although it contains 386 architecture signature 0x14C specific to COFF). I can't find any documentation on the format of these import objects. Does anybody know this format?
May be unofficial specs?
May be some source code that can process this format?
This is so-called Microsoft "short import" object. Basically, it consists of 20 bytes header (the same size as a regular COFF header), followed by two zero-terminated strings: import symbol name, and DLL name, respectively.
"Short import" header differs from a regular COFF header in the first four signature bytes: 0x00 0x00 0xFF 0xFF (no regular COFF can start with this, because it would read as "unknown machine, 65535 sections", which is nonsense).
The format of "short import" header is fully described here: MSDN PE Format.
So in the example above we have:
0x00 0x00 0xFF 0xFF --> "short import" signature
0x00 0x00 --> Version 0 (unused)
0x4C 0x01 --> Machine I386
0x39 0xE9 0x80 0x55 --> Time/Date stamp (17 Jun 2015, 6:27:53 UTC)
0x26 0x00 0x00 0x00 --> size of the strings following the header (38 bytes)
0x93 0x00 --> ordinal/hint (147)
0x08 0x00 --> bit field ("code", import by "name")