2

I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code:

<typeName> <functionName>(<typeName>)
{
  ulonglong myVar;

  __security_init_cookie();

  myVar = __scrt_initialize_crt(1);

  if ((char)myVar == '\0') {
    // some code
  }
}

where ulonglong is Unsigned Long Long Integer with a length of 8 according to Ghidra Decompiler.

I tried reading the __security_init_cookie() documentation here, to no avail. And there is not much documentation about the __scrt_initialize_crt() function.

I would appreciate it if you could help me understand what the above piece of code does.

P.S.1. More information about the __scrt_initialize_crt() function here, and its input type __scrt_module_type here.

P.S.2. I posted a follow-up question here on SO.

4
  • 2
    Some info here: stackoverflow.com/questions/19945479/…
    – ddddavidee
    Feb 28, 2022 at 10:33
  • @ddddavidee I had actually seen that post, though me being unfamiliar with MSVC, I do not comprehend the jargon.
    – Foad
    Feb 28, 2022 at 17:39
  • 1
    Typically, when reversing an executable, you ignore the CRT routines unless you suspect a custom CRT0, CRT1, etc. Reversing these routines usually adds no value to your understanding of the executable.
    – fpmurphy
    Mar 1, 2022 at 17:24
  • @fpmurphy yeah, after a couple of days reading documentation and blog posts... I am coming to the same conclusion. There doesn't seem to be any relation between the __security_init_cookie() and the __scrt_initialize_crt() instructions. The former seems to just insure functions have no side effects on the stack, and the latter just check if the instructions are called from a .dll file or a .exe executable.
    – Foad
    Mar 2, 2022 at 6:54

2 Answers 2

3

The documentation can be read in some of the header files which are bundled with Visual Studio. In my case I have the 2019 Community the files are here

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.16.27023

Additionally you can also reverse msvcrt.lib files which are present in my case at

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.16.27023\lib\spectre\onecore\x86

Now according to the headers at multiple locations for __security_init_cookie

// src\vcruntime\gs_cookie.c
/*
 * The global security cookie.  This name is known to the compiler.
 * Initialize to a garbage non-zero value just in case we have a buffer overrun
 * in any code that gets run before __security_init_cookie() has a chance to
 * initialize the cookie to the final value.
 */

// src\vcruntime\gs_support.c
/*
*Purpose:
*       Define __security_init_cookie, which is called at startup to initialize
*       the global buffer overrun security cookie used by the /GS compile flag.
*/

// src\vcruntime\vcruntime_dllmain.cpp
// The /GS security cookie must be initialized before any exception
// handling targetting the current image is registered.  No function
// using exception handling can be called in the current image until
// after __security_init_cookie has been called.

For __scrt_initialize_crt

// src\vcruntime\vcstartup_internal.h
// These are called during startup and termination to initialize or uninitialize
// the CRT.  When the CRT is statically linked, these actually perform complete
// CRT initialization, calling into each part of the CRT initialize them.  When
// the CRT DLLs are used, the CRT DLLs initialize themselves when they are loaded.
// However, some initialization is still required, to bind the module-specific
// VCRuntime DLL to the global AppCRT DLL.
extern "C" bool __cdecl __scrt_initialize_crt(__scrt_module_type module_type);

// src\vcruntime\utility.cpp
//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
//
// CRT Initialization
//
//-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
static bool is_initialized_as_dll;

extern "C" bool __cdecl __scrt_initialize_crt(__scrt_module_type const module_type)
{
    if (module_type == __scrt_module_type::dll)
    {
        is_initialized_as_dll = true;
    }

    __isa_available_init();

    // Notify the CRT components of the process attach, bottom-to-top:
    if (!__vcrt_initialize())
    {
        return false;
    }

    if (!__acrt_initialize())
    {
        __vcrt_uninitialize(false);
        return false;
    }

    return true;
}

1
  • did you just reverse the .lib files? 🤔 the content of the __scrt_initialize_crt function is identical to what I have mentioned in the P.S. above.
    – Foad
    Mar 1, 2022 at 13:25
3

i looked up at the follow up question in SO and i am posting a reply that lets you compile what you asked

I am not sure what purpose this can solve the header you are including vcxxx is a c only header and is to be used only to build crt and not to be used as a public header (vs2019 x64 190xx sdk vc src)

code compilation disassembly as follows

D:\test\scrt>dir /b
scrt.cpp

D:\test\scrt>type scrt.cpp
#define _VCRT_BUILD
#include <vcstartup_internal.h>
int __CRTDECL main(
        _In_                     int    argc,
        _In_reads_(argc) _Pre_z_ char** argv,
        _In_z_                   char** envp
        )
{
        UNREFERENCED_PARAMETER(argc);
        UNREFERENCED_PARAMETER(argv);
        UNREFERENCED_PARAMETER(envp);
        unsigned long long myVar;
        __security_init_cookie();
        myVar = __scrt_initialize_crt((__scrt_module_type)1);
        return 0;
}

compilation on vs2019 x64 19xxxx sdk crt src

D:\test\scrt>cl /Zi /W4 /analyze:autolog- /I d:\vs\VC\Tools\MSVC\14.29.30133\crt\src\vcruntime scrt.cpp /link /release
Microsoft (R) C/C++ Optimizing Compiler Version 19.29.30140 for x64
Copyright (C) Microsoft Corporation.  All rights reserved.

scrt.cpp
Microsoft (R) Incremental Linker Version 14.29.30140.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:scrt.exe
/debug
/release
scrt.obj

D:\test\scrt>dir /b
scrt.cpp
scrt.exe
scrt.obj
scrt.pdb
vc140.pdb

disassembly

D:\test\scrt>cdb -c "uf scrt!main;q" scrt.exe

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0:000> cdb: Reading initial command 'uf scrt!main;q'
scrt!main:
00007ff7`322b1000 4c89442418      mov     qword ptr [rsp+18h],r8
00007ff7`322b1005 4889542410      mov     qword ptr [rsp+10h],rdx
00007ff7`322b100a 894c2408        mov     dword ptr [rsp+8],ecx
00007ff7`322b100e 4883ec38        sub     rsp,38h
00007ff7`322b1012 e885000000      call    scrt!__security_init_cookie (00007ff7`322b109c)
00007ff7`322b1017 b901000000      mov     ecx,1
00007ff7`322b101c e837030000      call    scrt!__scrt_initialize_crt (00007ff7`322b1358)
00007ff7`322b1021 0fb6c0          movzx   eax,al
00007ff7`322b1024 4889442420      mov     qword ptr [rsp+20h],rax
00007ff7`322b1029 33c0            xor     eax,eax
00007ff7`322b102b 4883c438        add     rsp,38h
00007ff7`322b102f c3              ret
quit:
2
  • This is great. Thanks a lot. Can you be kind to post it on the other question? This post is meant to understand what those functions do, and the other question is an attempt to replicate the code and compiler options that generate an identical assembly code.
    – Foad
    Mar 8, 2022 at 20:40
  • I did not say that I am going to delete the question, but the temporary answer. these are two different questions on different forums. the question on this page was to understand the decompiled C code. And the question on SO is to replicate the original C/C++ code and the compiler options as much as possible.
    – Foad
    Mar 9, 2022 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.