1

I am reversing an ELF executable, and got the following:

0x080480ab      b880800408     movl $entry0, %eax          ; eip
0x080480b0      bb23810408     movl $section_end.LOAD0, %ebx ; section_end.LOAD0

It turned out that entry0 contains the beginning of the .text section and section_end.LOAD0 the end of it. However, this was not clear for immediately (entry0 is now clear, but I still do not know the origin of name section_end.LOAD0). Is there a documentation for these names? If not, can I ask radare2 to use memory addresses instead of these names?

Improve this question
2
  • 2
    Typically, those are explicitly exported symbols, and your disassembler helpfully replaces the addresses with the exported name.
    – Jongware
    Commented Jan 25, 2016 at 13:44
  • How can I improve the question dear downvoter?
    – robert
    Commented Jan 27, 2016 at 11:49

1 Answer 1

Reset to default
2

entry0 is the first entrypoint of your binary, section_end.LOAD0 is likely the end of the first (hence the 0) LOADable section :)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.