I was reversing this binary. While I tried to set a breakpoint in gdb
on main
function, it couldn't find its definition. Loading up the same binary in IDA shows up main
method in the Function
pane. Why isn't gdb being able to find symbol which IDA can?
1 Answer
The file you provided is a stripped elf executable. A related question can be found here. The main issue is that a stripped elf file has no main symbol. Instead, the loader uses the e_entry header field, which points to the C libs initialization code. When the initialization is done, it will yield execution to the program.
However, IDA is able to reconstruct the entry point by searching for this indirect jump.
Have a look at the very start of the .text section, you will find these lines:
8048637: 68 86 b7 04 08 push $0x804b786
804863c: e8 9f ff ff ff call 80485e0 <__libc_start_main@plt>
8048641: f4 hlt
The value being pushed here right before the call to libc's start function is the actual entry point. I hope this helps.