The Structure of a Managed Executable File

Chapter 3

The Structure of a Managed Executable File

Chapter 1, “Simple Sample,” introduced the managed executable file, known as a managed module and executed in the environment of the common language runtime. In this chapter, we’ll take a detailed look at the general structure of such a file. The file format of a managed module is based on the standard Microsoft Windows Portable Executable and Common Object File Format (PE/COFF) and is an extension of this format. Thus, formally, any managed module is a proper PE/COFF file, with additional features that identify it as a managed executable file.

Because the file format of a managed module conforms to the Windows PE/COFF standard, the operating system treats the managed module as an executable. And the extended, common language runtime specific information allows the runtime to immediately seize control over the module execution as soon as the operating system invokes the module. Figure 3-1 shows the structure of a managed PE/COFF file.

Figure 3-1 The general structure of a managed executable file.

Because IL assembly language (ILAsm) produces PE files only, this chapter concentrates on managed PE files—executables, also known as image files because they can be thought of as “memory images”—rather than pure COFF object files. (Actually, only one of the current managed compilers, Microsoft Managed C++ [MC++], produces object files as an intermediate step to PE files.)

This analysis of the managed PE file structure employs the following common definitions:

• File pointer  The location of an item within the file itself, before it is processed by the loader. This location is a position (an offset) within the file as it is stored on disk.

• Relative virtual address (RVA)  The address of an item once it has been loaded into memory, with the base address of the image file subtracted from it—in other words, the offset of an item within the image file loaded into memory. The RVA of an item almost always differs from its position within the file on disk (the file pointer).

• Virtual address (VA)  The same as the RVA except that the base address of the image file is not subtracted. The address is referred to as virtual because the operating system creates a distinct virtual address space for each process, independent of physical memory. For almost all purposes, a virtual address should be considered as simply an address. A virtual address is not as predictable as an RVA because the loader might not load the image at its preferred location if a conflict exists with any image file already loaded—a so-called base address conflict.

• Section  The basic unit of code or data within a PE/COFF file. In addition to code and data sections, an image file can contain a number of sections, such as .tls (thread local storage) or .reloc (relocations), that have special purposes. All the raw data in a section must be loaded contiguously.

  	Throughout this chapter (and indeed throughout the book), I use the term managed compiler to mean a compiler that targets the common language runtime and produces managed PE files. The term does not necessarily imply that the compiler itself is a managed application.