Introduction
On Windows, the compiler turns each source file into a .obj object file
in the COFF format (Common Object File Format), which the linker then joins into a
PE program or library. Microsoft’s compiler in
Visual Studio writes them, and so do
Clang and other compilers that target Windows. A static library
(.lib) is an archive of these object
files.
The .obj extension has other meanings. A 3D model in the
Wavefront OBJ format is a text file with the same
extension, and older DOS and Windows compilers wrote object files in a different format,
OMF. See
all the .OBJ variations.
Structure
A COFF object file has no signature. It starts directly with the 20-byte file header,
which is the same header a PE file has after its PE\0\0 signature: the
target machine (0x14C for 32-bit x86, 0x8664 for x64,
0xAA64 for 64-bit ARM), the number of sections, a timestamp, the position
and size of the symbol table, and an optional header size that is 0 for object files.
The section table follows, then each section’s raw data and its relocations: the places the linker must patch once it knows where everything ends up. The symbol table at the end lists the functions and variables the file defines and the ones it needs from elsewhere, in 18-byte records, followed by a string table for names longer than eight characters.
0file header: machine, section count, timestamp, symbol table position and count20 bytes20section table: name, size and data position of each section40 bytes each…section data, each followed by its relocationsvaries, 10 bytes per relocation…symbol table18 bytes each…string table: a 4-byte size, then long namesvaries
Also used for
- Wavefront OBJ .obj
Links
Software
- Visual Studio, whose
linkjoins them anddumpbinshows them (Windows) - LLVM, with
lld-linkandllvm-objdump(Windows, macOS, Linux) - GNU Binutils, with
objdump(Windows, macOS, Linux) - Ghidra (Windows, macOS, Linux)
- IDA Pro (Windows, macOS, Linux)
Developers
Reference
- PE Format, Microsoft’s specification of PE and COFF