Intel 80386 COFF Object File Format

Overview

COFF (Common Object File Format) is a binary file format used for executable, object, and shared library files. The Intel 80386 COFF variant is specifically designed for x86 architecture object files produced by compilers and assemblers. These files contain compiled machine code, debugging information, and metadata necessary for linking into executable programs.

Technical Details

File Extension: .o, .obj
MIME Type: application/x-object
Architecture: Intel x86 (80386 and later)
Byte Order: Little-endian
Format Type: Relocatable object file
Platform: Unix-like systems, Windows (PE/COFF)

COFF files contain:

• Machine code sections (.text, .data, .bss)
• Symbol tables and relocation information
• Debugging information
• Section headers and metadata

Key Features

• Multi-Section Support: Separate code, data, and BSS sections
• Symbol Management: Global and local symbol tables
• Relocation Information: Address resolution for linking
• Debugging Support: Source-level debugging information
• Cross-Platform: Standardized format across systems
• Incremental Linking: Support for partial linking

File Structure

COFF Object File Structure:
├── File Header
│   ├── Machine Type (0x014C for i386)
│   ├── Number of Sections
│   ├── Timestamp
│   ├── Symbol Table Pointer
│   ├── Number of Symbols
│   ├── Optional Header Size
│   └── Characteristics
├── Optional Header (if present)
├── Section Headers
│   ├── Section Name
│   ├── Virtual Size
│   ├── Virtual Address
│   ├── Raw Data Size
│   ├── Raw Data Pointer
│   ├── Relocations Pointer
│   ├── Line Numbers Pointer
│   └── Characteristics
├── Section Data
│   ├── .text (executable code)
│   ├── .data (initialized data)
│   ├── .bss (uninitialized data)
│   ├── .rdata (read-only data)
│   └── Custom sections
├── Relocation Tables
├── Line Number Information
└── Symbol Table
    ├── Symbol Entries
    └── String Table

Common Use Cases

1. Compilation Output: Compiler-generated object files
2. Static Libraries: Collections of object files
3. Incremental Builds: Separate compilation units
4. Cross-Platform Development: Portable object format
5. Embedded Systems: Firmware development
6. System Programming: Kernel and driver development

Section Types

Standard Sections

.text    - Executable code
.data    - Initialized data
.bss     - Uninitialized data (zero-filled)
.rdata   - Read-only data
.idata   - Import data
.edata   - Export data
.rsrc    - Resources
.reloc   - Relocation information

Section Characteristics

#define IMAGE_SCN_TYPE_NO_PAD           0x00000008
#define IMAGE_SCN_CNT_CODE              0x00000020
#define IMAGE_SCN_CNT_INITIALIZED_DATA  0x00000040
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
#define IMAGE_SCN_MEM_EXECUTE           0x20000000
#define IMAGE_SCN_MEM_READ              0x40000000
#define IMAGE_SCN_MEM_WRITE             0x80000000

Development Tools

GNU Toolchain

# Compile C source to object file
gcc -c source.c -o source.o

# Compile with debugging information
gcc -g -c source.c -o source.o

# Generate assembly listing
gcc -S source.c -o source.s
gcc -c source.s -o source.o

# View object file contents
objdump -h source.o        # Section headers
objdump -t source.o        # Symbol table
objdump -r source.o        # Relocation entries
objdump -d source.o        # Disassembly
objdump -s source.o        # Full contents

# Extract specific sections
objcopy -O binary --only-section=.text source.o text.bin

Microsoft Tools

REM Compile with Visual Studio
cl /c source.c

REM View object file information
dumpbin /headers source.obj
dumpbin /symbols source.obj
dumpbin /relocations source.obj
dumpbin /disasm source.obj

REM Link object files
link source.obj other.obj /out:program.exe

REM Create static library
lib source.obj other.obj /out:library.lib

Analysis Tools

# File type identification
file object.o
# object.o: ELF 32-bit LSB relocatable, Intel 80386, version 1

# Size information
size object.o

# String extraction
strings object.o

# Hexadecimal dump
hexdump -C object.o | head -20

# nm - symbol table listing
nm object.o
nm -g object.o  # Global symbols only
nm -u object.o  # Undefined symbols only

Programming Examples

C Source Example

// example.c
#include <stdio.h>

int global_var = 42;
static int static_var = 0;
extern int external_var;

void function1(void) {
    printf("Hello from function1\n");
    printf("global_var = %d\n", global_var);
}

static void static_function(void) {
    static_var++;
}

int main(void) {
    function1();
    static_function();
    return 0;
}

Assembly Output Analysis

# Compile and examine
gcc -c example.c -o example.o

# View symbol table
nm example.o
# Output:
# 0000000000000000 T function1
# 0000000000000000 D global_var
# 0000000000000000 T main
#                  U printf
# 0000000000000004 d static_var
# 000000000000002a t static_function

# Disassemble
objdump -d example.o

Relocation Information

# View relocations
objdump -r example.o

# Output example:
# RELOCATION RECORDS FOR [.text]:
# OFFSET   TYPE              VALUE
# 00000005 R_386_32          .rodata
# 0000000a R_386_PC32        printf
# 00000014 R_386_32          global_var

Linking Process

Static Linking

# Compile multiple object files
gcc -c file1.c -o file1.o
gcc -c file2.c -o file2.o
gcc -c file3.c -o file3.o

# Link into executable
gcc file1.o file2.o file3.o -o program

# Create static library
ar rcs libmylib.a file1.o file2.o file3.o

# Link with static library
gcc main.o -L. -lmylib -o program

Symbol Resolution

// Understanding symbol visibility

// Global symbol (visible to linker)
int global_function(void) {
    return 42;
}

// Static symbol (local to this object file)
static int local_function(void) {
    return 24;
}

// External symbol (defined elsewhere)
extern int external_function(void);

// Weak symbol (can be overridden)
__attribute__((weak)) int weak_function(void) {
    return 0;
}

Advanced Features

Debug Information

# Compile with DWARF debugging information
gcc -g -c source.c -o source.o

# View debugging sections
objdump -w source.o

# Extract debug information
objcopy --only-keep-debug source.o debug.o
objcopy --strip-debug source.o
objcopy --add-gnu-debuglink=debug.o source.o

Custom Sections

// Define custom sections
__attribute__((section(".mydata"))) int my_variable = 123;

__attribute__((section(".mycode"))) 
void my_function(void) {
    // Function in custom section
}

// Linker script usage
// SECTIONS {
//     .mydata : { *(.mydata) }
//     .mycode : { *(.mycode) }
// }

Position Independent Code

# Generate position-independent code
gcc -fPIC -c source.c -o source.o

# Useful for shared libraries
gcc -shared source.o -o libshared.so

Optimization and Analysis

Size Optimization

# Strip debugging symbols
strip object.o

# Remove unused sections
objcopy --remove-section=.comment object.o
objcopy --remove-section=.note object.o

# Optimize for size
gcc -Os -c source.c -o source.o

Performance Analysis

# Profile-guided optimization
gcc -fprofile-generate -c source.c -o source.o
# Run program to generate profile data
gcc -fprofile-use -c source.c -o source.o

# Link-time optimization
gcc -flto -c source.c -o source.o
gcc -flto source.o -o program

Cross-Platform Considerations

Architecture Differences

# Target specific architectures
gcc -m32 -c source.c -o source_32.o    # 32-bit x86
gcc -m64 -c source.c -o source_64.o    # 64-bit x86_64

# Cross-compilation
i386-linux-gnu-gcc -c source.c -o source.o

Endianness Handling

// Portable endianness handling
#include <stdint.h>
#include <arpa/inet.h>

uint32_t convert_endian(uint32_t value) {
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
    return htonl(value);  // Convert to network byte order
#else
    return value;         // Already in big-endian
#endif
}

Troubleshooting

Common Issues

# Undefined symbol errors
nm -u object.o  # List undefined symbols
ldd program     # Check dynamic dependencies

# Multiple definition errors
nm -g *.o | grep "T symbol_name"  # Find duplicate definitions

# Relocation errors
objdump -r object.o  # Check relocation entries
readelf -r object.o  # Alternative relocation viewer

Debugging Techniques

# Verbose linking
gcc -Wl,--verbose object.o -o program

# Map file generation
gcc -Wl,-Map=program.map object.o -o program

# Check for memory leaks in object construction
valgrind --tool=memcheck ./program

Security Considerations

Stack Protection

# Enable stack protection
gcc -fstack-protector-all -c source.c -o source.o

# Enable DEP/NX bit
gcc -Wl,-z,noexecstack object.o -o program

Address Space Layout Randomization

# Position independent executables
gcc -fPIE -c source.c -o source.o
gcc -pie source.o -o program

COFF object files remain fundamental to the compilation and linking process, serving as the intermediate representation between source code and executable programs while providing the necessary metadata for sophisticated linking and debugging capabilities.