I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. Why isn't gdb being able to find symbol which IDA can?

enter image description here

enter image description here

up vote 1 down vote accepted

The file you provided is a stripped elf executable. A related question can be found here. The main issue is that a stripped elf file has no main symbol. Instead, the loader uses the e_entry header field, which points to the C libs initialization code. When the initialization is done, it will yield execution to the program.

However, IDA is able to reconstruct the entry point by searching for this indirect jump.

Have a look at the very start of the .text section, you will find these lines:

 8048637:   68 86 b7 04 08          push   $0x804b786
 804863c:   e8 9f ff ff ff          call   80485e0 <__libc_start_main@plt>
 8048641:   f4                      hlt 

The value being pushed here right before the call to libc's start function is the actual entry point. I hope this helps.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.