Static analysis of Windows executable from a Linux platform

Question

I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using radare2. My problem is that most of the time I am unable to find the "real" code, for example the main function in a C/C++ application. Here is a method for this by looking for a call to __libc_start_main@plt, but I think this is only for Linux. For Linux executables radare2 usually shows a sym.main function, but not for Windows executables. In one case I spotted accidentally a sym._main, but I did not find it in other executables. Is there any method or tool which can solve my problem? I am looking for ideas for approaching both Assembly and C/C++ applications.

Answer 1

In case of Windows executables, the exe file has to export only the start entry point. Other entries can be exported also, but the first exported entry will be the starting point of the executable performing initialization actions. It is similar to the Linux case as it was described in your linked method, although the actual implementation of the start function is depend from your compiler.

If the symbols are stripped, you can find the main function by reversing the code from the start. Since the start is preforming initialization tasks, you will find the main somewhere near to the end of the start function. As an example, see the following image showing the main function of the calc.exe.

As you see, after the main was called, no more initialization steps is required, so the application can exit by calling the exit or _cexit library functions depending on the return value of the main.

Answer 2

I would suggest you tried out using OllyDbg with WINE. Kali linux has this combo pre-installed for that puprose and it works in every platform wine supports (ubuntu, open-suse, etc.).