undefined | Better HN

0 pointsrfl8908mo ago0 comments

You can make CRT-free Win32 programs, read this guide[1] and you're all set. I've written a couple CLI utilities which are completely CRT-free and weigh just under a few kilobytes.

[1]: https://nullprogram.com/blog/2023/02/15/

0 comments

8 comments · 2 top-level

matheusmoreira8mo ago· 6 in thread

Almost freestanding. It still requires you to link against kernel32 and use the functions it provides. This is because issuing system calls directly to the Windows kernel is not supported. The kernel developers reserve the right to change things like system call numbers, so they can't be hardcoded into the application.

rfl890OP8mo ago

Kernel32.dll is loaded into all Windows processes by default, so you actually can have a valid, working Windows binary with 0 entries in the import table. See here[1] for a "Hello world" program written as such.

[1]: https://gist.github.com/rfl890/195307136c7216cf243f7594832f4...

matheusmoreira8mo ago

That's interesting. How does it work?

  PEB *peb = (PEB *)__readgsqword(0x60);
    
  LIST_ENTRY *current_entry = peb->Ldr->InMemoryOrderModuleList.Flink->Flink;

It just obtains a pointer to the loader's data structures out of nowhere?

Is this actually supported by Microsoft or are people going to end up in a Raymond Chen article if they use this?

1 more reply

forrestthewoods8mo ago

> Almost freestanding. It still requires you to link against kernel32

Nitpick: the phrase “link against kernel32” feels like a Linux-ism. If you’re only calling a few function you need to load kernel32.dll and call some functions in it. But that’s a slightly different operation than linking against it. At least how I’ve always used the term link.

You’re not wrong in principle. But Linux and Windows do a lot of things differently wrt linking and loading libs. (I think Windows does it waaay better but ymmv)

17186274408mo ago

> (I think Windows does it waaay better but ymmv)

Can you elaborate on that?

Btw., I don't want to bash Windows here, I think the Windows core OS developers are (one of) the only good developers at Microsoft. The NT kernel is widely praised for its quality and the actual OS seems to be really solid. They just happen to also have lots of shitty company sections that release crappy software and bundle malware, ads and telemetry with the actual OS.

1 more reply

matheusmoreira8mo ago

Loading means creating a memory image of the library. Linking means resolving the symbols to addresses within that memory image.

Loading a library and calling some functions from it is linking. The function pointer you receive is your link to the library function.

1 more reply

17186274408mo ago

Linker is short for Link Loader, so I don't now what your definition of linking is, if it doesn't include loading.

forrestthewoods8mo ago

Great post!

j / k navigate · click thread line to collapse

0 comments

8 comments · 2 top-level

matheusmoreira8mo ago· 6 in thread

rfl890OP8mo ago

[1]: https://gist.github.com/rfl890/195307136c7216cf243f7594832f4...

matheusmoreira8mo ago

That's interesting. How does it work?

  PEB *peb = (PEB *)__readgsqword(0x60);
    
  LIST_ENTRY *current_entry = peb->Ldr->InMemoryOrderModuleList.Flink->Flink;

It just obtains a pointer to the loader's data structures out of nowhere?

Is this actually supported by Microsoft or are people going to end up in a Raymond Chen article if they use this?

1 more reply

forrestthewoods8mo ago

> Almost freestanding. It still requires you to link against kernel32

You’re not wrong in principle. But Linux and Windows do a lot of things differently wrt linking and loading libs. (I think Windows does it waaay better but ymmv)

17186274408mo ago

> (I think Windows does it waaay better but ymmv)

Can you elaborate on that?

1 more reply

matheusmoreira8mo ago

Loading means creating a memory image of the library. Linking means resolving the symbols to addresses within that memory image.

Loading a library and calling some functions from it is linking. The function pointer you receive is your link to the library function.

1 more reply

17186274408mo ago

Linker is short for Link Loader, so I don't now what your definition of linking is, if it doesn't include loading.

forrestthewoods8mo ago

Great post!

j / k navigate · click thread line to collapse