1

I am reversing an ELF executable, and got the following:

0x080480ab      b880800408     movl $entry0, %eax          ; eip
0x080480b0      bb23810408     movl $section_end.LOAD0, %ebx ; section_end.LOAD0

It turned out that entry0 contains the beginning of the .text section and section_end.LOAD0 the end of it. However, this was not clear for immediately (entry0 is now clear, but I still do not know the origin of name section_end.LOAD0). Is there a documentation for these names? If not, can I ask radare2 to use memory addresses instead of these names?

  • 2
    Typically, those are explicitly exported symbols, and your disassembler helpfully replaces the addresses with the exported name. – usr2564301 Jan 25 '16 at 13:44
  • How can I improve the question dear downvoter? – robert Jan 27 '16 at 11:49
2

entry0 is the first entrypoint of your binary, section_end.LOAD0 is likely the end of the first (hence the 0) LOADable section :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.