Borland C++ runtime startup

Question

I'm trying to reverse engineer an ages-old game compiled with Borland C++ in 1995. So far, I have found out that start @0x401000 passes to __startup in cw3220.dll (which apparently is Borland's C++ runtime dll) the following:

1. pointer to the begin of a list of global static constructors ({ char flag0; char flag1; void* fun})

2. pointer to end of said list

3. pointer to begin of a list of destructors (as above)
4. pointer to end of dtor list
5. int flag - GUI app or not (should __startup call main(argc,argv,env) or WinMain(hInstance,hPrevInstance,lpCmdLine,nShowCmd))
6. unknown int flag1
7. pointer to entry function
8. pointer to a function which IDA has automagically named matherr
9. pointer to a function matherrl
10. unknown int flag2
11. unknown int flag3

Is there any documentation available which tells the meaning of flag1/2/3 in the info struct, flag0/1 in the ctor list entries and how Borland C++ handles exceptions - functions using classes always call __InitExceptBlock, but I never see checks for exceptions after function calls, how is try/catch handled?

Answer 1

cw3220.dll indicates that you're looking at BC++ 5.0. AFAICS the only official documentation regarding the startup code is BC5/source/RTL/source/startup/Win32/c0nt.asm, plus _startup.h and startup.c (also somewhere under source/RTL). The struct is defined in _startup.h:

typedef struct module_data
{
    INIT *init_start;           /* start of a module's _INIT_ segment */
    INIT *init_end;             /* end of a module's _INIT_ segment */
    INIT *exit_start;           /* start of a module's _EXIT_ segment */
    INIT *exit_end;             /* end of a module's _EXIT_ segment */
    int  flags;                 /* flags (see below) */
    int  hmod;                  /* module handle */
    int  (*main)();             /* main/WinMain/_dllmain function */
    int  (*matherr)(void *);    /* (EXE only) _matherr function */
    int  (*matherrl)(void *);   /* (EXE only) _matherrl function */
    long stackbase;             /* (EXE only) base of stack */
    int  *fmode;                /* (EXE only) address of _fmode variable */
} MODULE_DATA;

/* MODULE_DATA flags.
 */
#define MF_WINDOWS  1           /* this is a Windows application */

If you install from PAKs then it can happen that the RTL sources don't get installed even if you select everything, but the RTL source is present in the BC5 directory on the installation CD (at least in my copy). That documents at least the calling side.

A lot of BC++ 4 internals were documented in the Borland Open Architecture Handbook that had to be ordered separately at nominal cost (one floppy). I can't locate the stuff ATM but I've seen copies floating around on the 'net, under the name of bc4boa.zip...