0

I was reversing this binary. While I tried to set a breakpoint in gdb on main function, it couldn't find its definition. Loading up the same binary in IDA shows up main method in the Function pane. Why isn't gdb being able to find symbol which IDA can?

enter image description here

enter image description here

1

The file you provided is a stripped elf executable. A related question can be found here. The main issue is that a stripped elf file has no main symbol. Instead, the loader uses the e_entry header field, which points to the C libs initialization code. When the initialization is done, it will yield execution to the program.

However, IDA is able to reconstruct the entry point by searching for this indirect jump.

Have a look at the very start of the .text section, you will find these lines:

 8048637:   68 86 b7 04 08          push   $0x804b786
 804863c:   e8 9f ff ff ff          call   80485e0 <__libc_start_main@plt>
 8048641:   f4                      hlt 

The value being pushed here right before the call to libc's start function is the actual entry point. I hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.