Understanding a C code including CRT functions, decompiled with Ghidra

Question

I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code:

<typeName> <functionName>(<typeName>)
{
  ulonglong myVar;

  __security_init_cookie();

  myVar = __scrt_initialize_crt(1);

  if ((char)myVar == '\0') {
    // some code
  }
}

where ulonglong is Unsigned Long Long Integer with a length of 8 according to Ghidra Decompiler.

I tried reading the __security_init_cookie() documentation here, to no avail. And there is not much documentation about the __scrt_initialize_crt() function.

I would appreciate it if you could help me understand what the above piece of code does.

P.S.1. More information about the __scrt_initialize_crt() function here, and its input type __scrt_module_type here.

P.S.2. I posted a follow-up question here on SO.

Answer 1

The documentation can be read in some of the header files which are bundled with Visual Studio. In my case I have the 2019 Community the files are here

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.16.27023

Additionally you can also reverse msvcrt.lib files which are present in my case at

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.16.27023\lib\spectre\onecore\x86

Now according to the headers at multiple locations for __security_init_cookie

// src\vcruntime\gs_cookie.c
/*
 * The global security cookie.  This name is known to the compiler.
 * Initialize to a garbage non-zero value just in case we have a buffer overrun
 * in any code that gets run before __security_init_cookie() has a chance to
 * initialize the cookie to the final value.
 */

// src\vcruntime\gs_support.c
/*
*Purpose:
*       Define __security_init_cookie, which is called at startup to initialize
*       the global buffer overrun security cookie used by the /GS compile flag.
*/

// src\vcruntime\vcruntime_dllmain.cpp
// The /GS security cookie must be initialized before any exception
// handling targetting the current image is registered.  No function
// using exception handling can be called in the current image until
// after __security_init_cookie has been called.

For __scrt_initialize_crt

// src\vcruntime\vcstartup_internal.h
// These are called during startup and termination to initialize or uninitialize
// the CRT.  When the CRT is statically linked, these actually perform complete
// CRT initialization, calling into each part of the CRT initialize them.  When
// the CRT DLLs are used, the CRT DLLs initialize themselves when they are loaded.
// However, some initialization is still required, to bind the module-specific
// VCRuntime DLL to the global AppCRT DLL.
extern "C" bool __cdecl __scrt_initialize_crt(__scrt_module_type module_type);

// src\vcruntime\utility.cpp
//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
//
// CRT Initialization
//
//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
static bool is_initialized_as_dll;

extern "C" bool __cdecl __scrt_initialize_crt(__scrt_module_type const module_type)
{
    if (module_type == __scrt_module_type::dll)
    {
        is_initialized_as_dll = true;
    }

    __isa_available_init();

    // Notify the CRT components of the process attach, bottom-to-top:
    if (!__vcrt_initialize())
    {
        return false;
    }

    if (!__acrt_initialize())
    {
        __vcrt_uninitialize(false);
        return false;
    }

    return true;
}

Answer 2

i looked up at the follow up question in SO and i am posting a reply that lets you compile what you asked

I am not sure what purpose this can solve the header you are including vcxxx is a c only header and is to be used only to build crt and not to be used as a public header (vs2019 x64 190xx sdk vc src)

code compilation disassembly as follows

D:\test\scrt>dir /b
scrt.cpp

D:\test\scrt>type scrt.cpp
#define _VCRT_BUILD
#include <vcstartup_internal.h>
int __CRTDECL main(
        _In_                     int    argc,
        _In_reads_(argc) _Pre_z_ char** argv,
        _In_z_                   char** envp
        )
{
        UNREFERENCED_PARAMETER(argc);
        UNREFERENCED_PARAMETER(argv);
        UNREFERENCED_PARAMETER(envp);
        unsigned long long myVar;
        __security_init_cookie();
        myVar = __scrt_initialize_crt((__scrt_module_type)1);
        return 0;
}

compilation on vs2019 x64 19xxxx sdk crt src

D:\test\scrt>cl /Zi /W4 /analyze:autolog- /I d:\vs\VC\Tools\MSVC\14.29.30133\crt\src\vcruntime scrt.cpp /link /release
Microsoft (R) C/C++ Optimizing Compiler Version 19.29.30140 for x64
Copyright (C) Microsoft Corporation.  All rights reserved.

scrt.cpp
Microsoft (R) Incremental Linker Version 14.29.30140.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:scrt.exe
/debug
/release
scrt.obj

D:\test\scrt>dir /b
scrt.cpp
scrt.exe
scrt.obj
scrt.pdb
vc140.pdb

disassembly

D:\test\scrt>cdb -c "uf scrt!main;q" scrt.exe

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0:000> cdb: Reading initial command 'uf scrt!main;q'
scrt!main:
00007ff7`322b1000 4c89442418      mov     qword ptr [rsp+18h],r8
00007ff7`322b1005 4889542410      mov     qword ptr [rsp+10h],rdx
00007ff7`322b100a 894c2408        mov     dword ptr [rsp+8],ecx
00007ff7`322b100e 4883ec38        sub     rsp,38h
00007ff7`322b1012 e885000000      call    scrt!__security_init_cookie (00007ff7`322b109c)
00007ff7`322b1017 b901000000      mov     ecx,1
00007ff7`322b101c e837030000      call    scrt!__scrt_initialize_crt (00007ff7`322b1358)
00007ff7`322b1021 0fb6c0          movzx   eax,al
00007ff7`322b1024 4889442420      mov     qword ptr [rsp+20h],rax
00007ff7`322b1029 33c0            xor     eax,eax
00007ff7`322b102b 4883c438        add     rsp,38h
00007ff7`322b102f c3              ret
quit: