# how to find main in striped bainary. using r2. and gdb. (1)
in this case we are going to find main on /bin/ls. first we gone run r2 on ls. run: $ r2 /bin/ls now run aaa for analyze. run: > aaa now run pdf to extract the assembly code on that section. run: > pd

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
New Reply

Threaded Mode how to find main in striped bainary. using r2. and gdb.

BIP
Newbie
Posts:
7
Threads:
1
Joined:
Apr 2023
Reputation:
0
Credits: 5€ [Donate]
#1
04-23-2023, 11:16 AM
in this case we are going to find main on /bin/ls.
first we gone run r2 on ls.
run:
$ r2 /bin/ls
now run aaa for analyze.
run:
[0x00006180]> aaa
now run pdf to extract the assembly code on that section.
run:
[0x00006180]> pdf
output will be like this:
;-- rip:
┌ 43: entry0 (int64_t arg3);
│ ; arg int64_t arg3 @ rdx
│ 0x00006180 31ed xor ebp, ebp
│ 0x00006182 4989d1 mov r9, rdx ; arg3
│ 0x00006185 5e pop rsi
│ 0x00006186 4889e2 mov rdx, rsp
│ 0x00006189 4883e4f0 and rsp, 0xfffffffffffffff0
│ 0x0000618d 50 push rax
│ 0x0000618e 54 push rsp
│ 0x0000618f 4c8d050a2201. lea r8, [0x000183a0]
│ ; DATA XREF from fcn.00017700 @ 0x177b3
│ 0x00006196 488d0da32101. lea rcx, [0x00018340]
│ 0x0000619d 488d3dbce5ff. lea rdi, [main] ; 0x4760 ; "AWAVAUATL\x8d%Lb\x01"
│ 0x000061a4 ff152ede0100 call qword [reloc.__libc_start_main] ; [0x23fd8:8]=0
└ 0x000061aa f4 hlt
now what we wan't here is main now if you look at the output you see call "qword [reloc.__libc_start_main] ;" this line of code is a function call that calls function __libc_start_main
now it's time to use gdb.
run:
$ gdb /bin/ls
make assembly pretty optional:
$ set disassembly-flavor intel
set a break point on __libc_start_main.
run:
$ break __libc_start_main
and press y. if it asks.
now hit r for run.
run:
$ r
you will hit you'r break point.
output:
Breakpoint 1, __libc_start_main_impl (main=0x555555558760, argc=1,
argv=0x7fffffffe018, init=0x55555556c340, fini=0x55555556c3a0,
rtld_fini=0x7ffff7fceaa0 <_dl_fini>, stack_end=0x7fffffffe008)
at ../csu/libc-start.c:340
340 ../csu/libc-start.c: No such file or directory.
0x555555558760 is our main.
if you wan't to set break point on out main run:
$ break *0x555555558760
if you like this post. support me with monero:
45b6mPvTeKXE2QWEDK1c6YiYPrUeHvjMaCLGX4RwjxYyeSrGSdWeJJZcMbkyoUp6qGaa4Z1aoj71sQFftDxwxFo8BPvHuZP
PM Rate
Report

« Next Oldest | Next Newest »

New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| trying to find databases of HIBP | bornLosing | 3 | 130 | 05-26-2023, 06:39 AM Last Post: DataBroker
| I need money can you help me find the truck? | ellcj | 8 | 243 | 05-12-2023, 12:37 AM Last Post: lp922

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }