3 ms·

> To execute a Windows .exe then you just load it into memory (which requires unpacking the .exe file format) and tell the processor to jump to the first instru

> To execute a Windows .exe then you just load it into memory (which requires unpacking the .exe file format) and tell the processor to jump to the first instruction. Obviously a simplification, worth mentioning maybe at a slightly deeper level https://learn.microsoft.com/en-us/cpp/c-language/thread-local-storage?view=msvc-170 https://learn.microsoft.com/en-us/cpp/c-language/thread-loca... I think a PE32 (.exe) can have multiple sections like this that are implicitly started before main()/entrypoint basically

userbinator 4y ago
TLS callbacks are a relatively common trick used by packers/obfuscators. AFAIK, the only other code that can get executed before the main entrypoint of the PE would be the entrypoints ("DllMain") of its imported DLLs.
- andrewf 4y ago
  Lots of 32-bit Windows apps shipped with 16-bit installers (old versions of InstallShield and the like). When MS dropped Win16 support from x64 Windows, they built native implementations which "ran" the 16-bit installer based on the resources packed into it. In console emulation terms, they supported 16-bit InstallShield and friends with a HLE (High Level Emulation) approach rather than continuing to execute the original binaries on top of a low-level emulation. For a hobby/minimalist Win32 implementation I wonder if HLE support for popular packers/obfuscators would be easier than getting the low level details right?