How to find main() in binary?

Question

Given a binary and only using a tool like ndisasm, how can I find main()? I don't want to use smart tools like IDA Pro because I'm doing this exercise to learn.

Answer 1

This is quite tricky and necessitates a LOT of patience. I'll assume here that you're trying to find the main function as it is defined in C and not as the entry point of your program. It's very hard to find what you're looking for by scanning the code with your eyes & brain. But here's a way. What you can do is first check the header of the binary file you're trying to disassemble. Below you'll find the output of readelf -h on a random file. If the file isn't damaged (on purpose or not) you'll be able to find the Entry point address.

  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x400440
  Start of program headers:          64 (bytes into file)
  Start of section headers:          4680 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         8
  Size of section headers:           64 (bytes)
  Number of section headers:         35
  Section header string table index: 32

This address usually points to the location of the first chunk of code which will be executed at run time (_start function) and which will handle the main function parameters (or command line arguments) before calling the main function. Another technique would be to run your program under a debugger (GDB for instance) and go step by step.

I have to warn you though, if you're dealing with ELF binaries, things could turn out to be more complicated as they contain ctor and dtor tables which hold pointers to functions that are executed before and after the main function. You have also some undocumented weirdness going on when dealing with statically linked binaries. And of course, other programs can make do without a main function and call whatever they wish.