19

I am looking for a more technical explanation than the OS calls the function.

Is there a website or book?

0

5 Answers 5

27

The .exe file (or equivalent on other platforms) contains an 'entry point' address. To a first approximation, the OS loads the relevant sections of the .EXE file into RAM, and then jumps to the entry point.

As others have said, this entry point will not be 'main', but will instead be a part of the runtime library - it will do things like initialising static objects, setting up the argc and argv parameters, setting up standard input, standard output, standard error, etc. When it's done all that, it will call your main() function. When main exits, the runtime goes through an analogous process of passing your return code back to the environment, calling static destructors, calling _atexit routines, etc.

If you have Microsoft tools (perhaps not the freebie ones), then you have all the runtime source, and an easy way to look at it is to put a breakpoint on the closing brace of your main() method, and single step back up into the runtime.

8

main() is part of the C library and is not a system function. I don't know for OS X or Linux, but Windows usually starts a program with WinMainCRTStartup(). This symbol init your process, extract command line arguments and environment (argc, argv, end) and calls main(). It is also responsible of calling any code that should run after main(), like atexit().

By looking in your Visual Studio file, you should be able to find the default implementation of WinMainCRTStartup to see what it does.

You can also define a function of your own to call at startup, this is done by changing "entry point" in the linker options. This is often a function that takes no arguments and returns a void.

6

As far as Windows goes, the entry point functions are:

  • Console: void __cdecl mainCRTStartup( void ) {}
  • GUI: void __stdcall WinMainCRTStartup( void ) {}
  • DLL: BOOL __stdcall _DllMainCRTStartup(HINSTANCE hinstDLL,DWORD fdwReason,void* lpReserved) {}

The only reason to use these over the normal main, WinMain, and DllMain is if you wanted to use your own run time library. (If you want smaller file size or custom features.)

For custom run-time implementations and other tricks to get smaller PE files, see:

2
  • Three of the four links are broken (only The Code Project link works). E.g., "We are sorry, the page you requested cannot be found.", "404", and "Hmm. We’re having trouble finding that site. We can’t connect to the server at www.hailstorm.net.". Jun 27, 2022 at 21:13
  • 1
    @PeterMortensen Yes, 14 years later links tend to break. Fixed now.
    – Anders
    Jun 27, 2022 at 21:34
2

It's OS dependent. In OS X, there's a frame in the mach header that contains the start address for the EIP (instruction pointer) register.

Once the binary is loaded, the OS launches execution from this address:

cristi:test diciu$ otool -l ./a.out | grep -A 10 LC_UNIXTHREAD
        cmd LC_UNIXTHREAD
    cmdsize 80
     flavor i386_THREAD_STATE
      count i386_THREAD_STATE_COUNT
[..]
        ss  0x00000000 eflags 0x00000000 eip 0x00001f8c cs  0x00000000
[..]

The address is the address of the "start" function from the binary:

cristi:test diciu$ nm ./a.out
0000200c D _NXArgc
00002008 D _NXArgv
00002000 D ___progname
00001fe0 t __dyld_func_lookup
00001000 A __mh_execute_header
[..]
00001f8c T start

In Mac OS X, it's the "start" function that gets called first, even before the "main" function:

(gdb) b start
Breakpoint 1 at 0x1f90
(gdb) b main
Breakpoint 2 at 0x1ff4
(gdb) r
Starting program: /Users/diciu/Programming/test/a.out 
Reading symbols for shared libraries ++. done

Breakpoint 1, 0x00001f90 in start ()
1

Expert C++/CLI (check around page 279) has very specific details of the different bootstrap scenarios for native, mixed, and pure CLR assemblies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.