CODEWITHSUNDEEP
object-files
kepe
kepe

Reputation: 252

What is the format of win64?

What is the format of the win64 format produced by nasm -f win64? This program:

    extern GetStdHandle, WriteConsoleA, ExitProcess
section .bss
    dummy resd 1
section .data
    msg db "abc"
    msglen equ $ - msg
section .text
_start:
    mov rcx, STD_OUTPUT_HANDLE
    call GetStdHandle

    mov rcx, rax
    mov rdx, msg
    mov r8, msglen
    mov r9, dummy
    push NULL
    call WriteConsoleA

    mov rcx, 0
    call ExitProcess

NULL equ 0
STD_OUTPUT_HANDLE equ -11

produces an object file with some things, like the included external functions (GetStdHandle, WriteConsoleA, and ExitProcess), the abc string, and variable names (msg).

What is the exact format of this? I couldn't find any specification for Win64 online.

Upvotes: 1

Views: 316

Answers (1)

kepe
kepe

Reputation: 252

The first time I saw this link, I totally did not realize it talked about both the image file format (PE) and the object file format (COFF). The object file format is what I'm looking for. Quote:

This document specifies the structure of executable (image) files and object files under the Microsoft Windows family of operating systems. These files are referred to as Portable Executable (PE) and Common Object File Format (COFF) files, respectively. The name "Portable Executable" refers to the fact that the format is not architecture specific.

(emphasis mine)

Upvotes: 1

Related Questions