Search code examples
windowsreverse-engineering

How the globals are initialized before entry point?


I'm trying to figure out how Windows manages to map the memory of a PE file into the address space, so I've seen something that makes me confused.

Let's say we have something like this:

HMODULE some_module = GetModuleHandleA(NULL);

int main() { // Or DllMain doesn't matter

    // some operations using some_module or whatever

    return 0;

}

The initialization of some_module is performed before entry point is called. I'm trying to implement this looking into the PE file (I found the initialization functions), but only thing I can see is that those initialization functions are used as RUNTIME_FUNCTION, nothing else. How can I extract those initialization functions among all the runtime functions and call them manually? Are there any documentation about this? I also tried a function called RtlAddFunctionTable but I think it's not made for that. What kind of operations can performed to implement that? Thanks.


Solution

  • Problem is solved, was about a different thing. But I had some research and see that those entries (runtime functions, includes static initializations) are already called in entry point. Those functions are specified as some memory range and called by a function called "ucrtbase!initterm" (or "ucrtbase!_initterm"). In some PE files that initterm function is compiled as a new function, instead of using an import from ucrtbase. And finally, those functions are called in an order of where they're located in memory (lower-address -> upper-address).