var unreadAlerts = '1';
You have one unread private message from dkota titled Welcome to the Forum!

how to find main in striped bainary. using r2. and gdb.
#1
in this case we are going to find main on /bin/ls.

first we gone run r2 on ls.

run:

$ r2 /bin/ls

now run aaa for analyze.

run:

[0x00006180]> aaa

now run pdf to extract the assembly code on that section.

run:

[0x00006180]> pdf

output will be like this:

;-- rip:
┌ 43: entry0 (int64_t arg3);
│ ; arg int64_t arg3 @ rdx
│ 0x00006180 31ed xor ebp, ebp
│ 0x00006182 4989d1 mov r9, rdx ; arg3
│ 0x00006185 5e pop rsi
│ 0x00006186 4889e2 mov rdx, rsp
│ 0x00006189 4883e4f0 and rsp, 0xfffffffffffffff0
│ 0x0000618d 50 push rax
│ 0x0000618e 54 push rsp
│ 0x0000618f 4c8d050a2201. lea r8, [0x000183a0]
│ ; DATA XREF from fcn.00017700 @ 0x177b3
│ 0x00006196 488d0da32101. lea rcx, [0x00018340]
│ 0x0000619d 488d3dbce5ff. lea rdi, [main] ; 0x4760 ; "AWAVAUATL\x8d%Lb\x01"
│ 0x000061a4 ff152ede0100 call qword [reloc.__libc_start_main] ; [0x23fd8:8]=0
└ 0x000061aa f4 hlt

now what we wan't here is main now if you look at the output you see call "qword [reloc.__libc_start_main] ;" this line of code is a function call that calls function __libc_start_main

now it's time to use gdb.

run:

$ gdb /bin/ls

make assembly pretty optional:

$ set disassembly-flavor intel

set a break point on __libc_start_main.

run:

$ break __libc_start_main

and press y. if it asks.

now hit r for run.

run:

$ r

you will hit you'r break point.

output:

Breakpoint 1, __libc_start_main_impl (main=0x555555558760, argc=1,
argv=0x7fffffffe018, init=0x55555556c340, fini=0x55555556c3a0,
rtld_fini=0x7ffff7fceaa0 <_dl_fini>, stack_end=0x7fffffffe008)
at ../csu/libc-start.c:340
340 ../csu/libc-start.c: No such file or directory.

0x555555558760 is our main.

if you wan't to set break point on out main run:

$ break *0x555555558760

if you like this post. support me with monero:

45b6mPvTeKXE2QWEDK1c6YiYPrUeHvjMaCLGX4RwjxYyeSrGSdWeJJZcMbkyoUp6qGaa4Z1aoj71sQFftDxwxFo8BPvHuZP
Report


Quick Reply
Message
Type your reply to this message here.



Possibly Related Threads…
Thread Author Replies Views Last Post
  trying to find databases of HIBP bornLosing 3 130 05-26-2023, 06:39 AM
Last Post: DataBroker
  I need money can you help me find the truck? ellcj 8 243 05-12-2023, 12:37 AM
Last Post: lp922



Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }