这里的源代码自然不是指.net Framework的源码，不过微软公开了一个代号为rotor的open source cli的源码，你可以把它看为轻量级的.net framework。最关键的是，它俩的运行机理大致相同。今天，我们就从rotor的源码中看看做为程序调试最基本的exe文件的动态加载。同样，先给出参考文献，免得有人说我抄袭。《inside the rotor cli》，另一本是《shared source cli》，只不过网上搞不到。当然，还要从MSDN的网站下载sscli2.0压缩包。
    和win32下一样，系统会提供一个loader将exe读入，sscli中提供了另一个loader的例子：clix.exe。我们暂且把它看为系统默认的loader，来看源码（clix.cpp），注意红色的代码

DWORD Launch(WCHAR* pFileName, WCHAR* pCmdLine)
{
    WCHAR exeFileName[MAX_PATH + 1];
    DWORD dwAttrs;
    DWORD dwError;
    DWORD nExitCode;

...
[color=green]//这里进行一系列文件的属性检查[/color]
...
 
    if (dwError != ERROR_SUCCESS) {
        // We can't find the file, or there's some other problem. Exit with an error.
        fwprintf(stderr, L"%s: ", pFileName);
        DisplayMessageFromSystem(dwError);
        return 1;   // error
    }
[color=red]    nExitCode = _CorExeMain2(NULL, 0, pFileName, NULL, pCmdLine);[/color]

    // _CorExeMain2 never returns with success
    _ASSERTE(nExitCode != 0);

    DisplayMessageFromSystem(::GetLastError());

    return nExitCode;
}

[color=red].text:79011B47                 push    offset a_corexemain ; "_CorExeMain"[/color]
.text:79011B4C                 push    [ebp+hModule]   ; hModule
.text:79011B4F                 call    ds:__imp__GetProcAddress@8 ; GetProcAddress(x,x)
.text:79011B55                 test    eax, eax
.text:79011B57                 jz      loc_79019B46
[color=red].text:79011B5D                 call    eax[/color]

__int32 STDMETHODCALLTYPE _CorExeMain2( // Executable exit code.
    PBYTE   pUnmappedPE,                // -> memory mapped code
    DWORD   cUnmappedPE,                // Size of memory mapped code
    __in LPWSTR  pImageNameIn,          // -> Executable Name
    __in LPWSTR  pLoadersFileName,      // -> Loaders Name
    __in LPWSTR  pCmdLine)              // -> Command Line
{

    // This entry point is used by clix
    BOOL bRetVal = 0;

    //BEGIN_ENTRYPOINT_VOIDRET;

    // Before we initialize the EE, make sure we've snooped for all EE-specific
    // command line arguments that might guide our startup.
    HRESULT result = CorCommandLine::SetArgvW(pCmdLine);

    if (!CacheCommandLine(pCmdLine, CorCommandLine::GetArgvW(NULL))) {
        LOG((LF_STARTUP, LL_INFO10, "Program exiting - CacheCommandLine failed\n"));
        bRetVal = -1;
        goto exit;
    }

    if (SUCCEEDED(result))
[color=red]        result = CoInitializeEE(COINITEE_DEFAULT | COINITEE_MAIN);[/color]

    if (FAILED(result)) {
        VMDumpCOMErrors(result);
        SetLatchedExitCode (-1);
        goto exit;
    }

    // This is here to get the ZAPMONITOR working correctly
    INSTALL_UNWIND_AND_CONTINUE_HANDLER;


    // Load the executable
[color=red]    bRetVal = ExecuteEXE(pImageNameIn);[/color]

...
...
    

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课