04-23-2023, 11:16 AM
in this case we are going to find main on /bin/ls.
first we gone run r2 on ls.
run:
$ r2 /bin/ls
now run aaa for analyze.
run:
[0x00006180]> aaa
now run pdf to extract the assembly code on that section.
run:
[0x00006180]> pdf
output will be like this:
;-- rip:
┌ 43: entry0 (int64_t arg3);
│ ; arg int64_t arg3 @ rdx
│ 0x00006180 31ed xor ebp, ebp
│ 0x00006182 4989d1 mov r9, rdx ; arg3
│ 0x00006185 5e pop rsi
│ 0x00006186 4889e2 mov rdx, rsp
│ 0x00006189 4883e4f0 and rsp, 0xfffffffffffffff0
│ 0x0000618d 50 push rax
│ 0x0000618e 54 push rsp
│ 0x0000618f 4c8d050a2201. lea r8, [0x000183a0]
│ ; DATA XREF from fcn.00017700 @ 0x177b3
│ 0x00006196 488d0da32101. lea rcx, [0x00018340]
│ 0x0000619d 488d3dbce5ff. lea rdi, [main] ; 0x4760 ; "AWAVAUATL\x8d%Lb\x01"
│ 0x000061a4 ff152ede0100 call qword [reloc.__libc_start_main] ; [0x23fd8:8]=0
└ 0x000061aa f4 hlt
now what we wan't here is main now if you look at the output you see call "qword [reloc.__libc_start_main] ;" this line of code is a function call that calls function __libc_start_main
now it's time to use gdb.
run:
$ gdb /bin/ls
make assembly pretty optional:
$ set disassembly-flavor intel
set a break point on __libc_start_main.
run:
$ break __libc_start_main
and press y. if it asks.
now hit r for run.
run:
$ r
you will hit you'r break point.
output:
Breakpoint 1, __libc_start_main_impl (main=0x555555558760, argc=1,
argv=0x7fffffffe018, init=0x55555556c340, fini=0x55555556c3a0,
rtld_fini=0x7ffff7fceaa0 <_dl_fini>, stack_end=0x7fffffffe008)
at ../csu/libc-start.c:340
340 ../csu/libc-start.c: No such file or directory.
0x555555558760 is our main.
if you wan't to set break point on out main run:
$ break *0x555555558760
if you like this post. support me with monero:
45b6mPvTeKXE2QWEDK1c6YiYPrUeHvjMaCLGX4RwjxYyeSrGSdWeJJZcMbkyoUp6qGaa4Z1aoj71sQFftDxwxFo8BPvHuZP
first we gone run r2 on ls.
run:
$ r2 /bin/ls
now run aaa for analyze.
run:
[0x00006180]> aaa
now run pdf to extract the assembly code on that section.
run:
[0x00006180]> pdf
output will be like this:
;-- rip:
┌ 43: entry0 (int64_t arg3);
│ ; arg int64_t arg3 @ rdx
│ 0x00006180 31ed xor ebp, ebp
│ 0x00006182 4989d1 mov r9, rdx ; arg3
│ 0x00006185 5e pop rsi
│ 0x00006186 4889e2 mov rdx, rsp
│ 0x00006189 4883e4f0 and rsp, 0xfffffffffffffff0
│ 0x0000618d 50 push rax
│ 0x0000618e 54 push rsp
│ 0x0000618f 4c8d050a2201. lea r8, [0x000183a0]
│ ; DATA XREF from fcn.00017700 @ 0x177b3
│ 0x00006196 488d0da32101. lea rcx, [0x00018340]
│ 0x0000619d 488d3dbce5ff. lea rdi, [main] ; 0x4760 ; "AWAVAUATL\x8d%Lb\x01"
│ 0x000061a4 ff152ede0100 call qword [reloc.__libc_start_main] ; [0x23fd8:8]=0
└ 0x000061aa f4 hlt
now what we wan't here is main now if you look at the output you see call "qword [reloc.__libc_start_main] ;" this line of code is a function call that calls function __libc_start_main
now it's time to use gdb.
run:
$ gdb /bin/ls
make assembly pretty optional:
$ set disassembly-flavor intel
set a break point on __libc_start_main.
run:
$ break __libc_start_main
and press y. if it asks.
now hit r for run.
run:
$ r
you will hit you'r break point.
output:
Breakpoint 1, __libc_start_main_impl (main=0x555555558760, argc=1,
argv=0x7fffffffe018, init=0x55555556c340, fini=0x55555556c3a0,
rtld_fini=0x7ffff7fceaa0 <_dl_fini>, stack_end=0x7fffffffe008)
at ../csu/libc-start.c:340
340 ../csu/libc-start.c: No such file or directory.
0x555555558760 is our main.
if you wan't to set break point on out main run:
$ break *0x555555558760
if you like this post. support me with monero:
45b6mPvTeKXE2QWEDK1c6YiYPrUeHvjMaCLGX4RwjxYyeSrGSdWeJJZcMbkyoUp6qGaa4Z1aoj71sQFftDxwxFo8BPvHuZP