2

I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using radare2. My problem is that most of the time I am unable to find the "real" code, for example the main function in a C/C++ application. Here is a method for this by looking for a call to __libc_start_main@plt, but I think this is only for Linux. For Linux executables radare2 usually shows a sym.main function, but not for Windows executables. In one case I spotted accidentally a sym._main, but I did not find it in other executables. Is there any method or tool which can solve my problem? I am looking for ideas for approaching both Assembly and C/C++ applications.

  • 2
    start from entry0 in windows this would be the address where execution starts and most likely be WinMainCrt the path from here to actual winmain() is rather common (standard compiler generated code) – blabb Feb 4 '16 at 8:37
2

In case of Windows executables, the exe file has to export only the start entry point. Other entries can be exported also, but the first exported entry will be the starting point of the executable performing initialization actions. It is similar to the Linux case as it was described in your linked method, although the actual implementation of the start function is depend from your compiler.

If the symbols are stripped, you can find the main function by reversing the code from the start. Since the start is preforming initialization tasks, you will find the main somewhere near to the end of the start function. As an example, see the following image showing the main function of the calc.exe.

enter image description here

As you see, after the main was called, no more initialization steps is required, so the application can exit by calling the exit or _cexit library functions depending on the return value of the main.

  • This is compiler-induced, the PE format doesn't have to export start. – Dillinur Feb 4 '16 at 17:24
0

I would suggest you tried out using OllyDbg with WINE. Kali linux has this combo pre-installed for that puprose and it works in every platform wine supports (ubuntu, open-suse, etc.).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.