Start analysis at any position in elf is Entry Point?

Question

An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ??

please help me! Thank all.

Answer 1

The entry point isn't the address where you starts analyzing, but the address from where the process starts executing.

Let's have a quick look at the ELF32 Header:

#define EI_NIDENT 16

typedef struct {
        unsigned char   e_ident[EI_NIDENT];
        Elf32_Half      e_type;
        Elf32_Half      e_machine;
        Elf32_Word      e_version;
        Elf32_Addr      e_entry;
        Elf32_Off       e_phoff;
        Elf32_Off       e_shoff;
        Elf32_Word      e_flags;
        Elf32_Half      e_ehsize;
        Elf32_Half      e_phentsize;
        Elf32_Half      e_phnum;
        Elf32_Half      e_shentsize;
        Elf32_Half      e_shnum;
        Elf32_Half      e_shstrndx;
} Elf32_Ehdr;

The e_entry member is actually pointing to the entry point:

e_entry
This member gives the virtual address to which the system first transfers control, thus starting the process. If the file has no associated entry point, this member holds zero.

Source: http://www.sco.com/developers/gabi/latest/ch4.eheader.html

And a more detailed description from Wikipedia:

In computer programming, an entry point is where control is transferred from the operating system to a computer program, at which place the processor enters a program or a code fragment and execution begins. In some operating systems or programming languages, the initial entry is not part of the program but of the runtime library, in which case the runtime library initializes the program and then the runtime library enters the program. In other cases, the program may call the runtime library before doing anything when it is entered for the first time, and, after the runtime library returns, the actual code of the program begins to execute. This marks the transition from load time (and dynamic link time, if present) to run time.

[emphasis mine]

Answer 2

No!

Entry point is the "keyword" used to point at the location at which the OS loader will start a program. For a given binary file (ELFBIN), you can run the following command to read the binary's header information (-h):

       readelf -h ELFBIN

You'll obtain an output similar to this:

 ELF Header:
 Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
 Class:                             ELF64
 Data:                              2's complement, little endian
 Version:                           1 (current)
 OS/ABI:                            UNIX - System V
 ABI Version:                       0
 Type:                              EXEC (Executable file)
 Machine:                           Advanced Micro Devices X86-64
 Version:                           0x1
 Entry point address:               0x400a80
 Start of program headers:          64 (bytes into file)
 Start of section headers:          46528 (bytes into file)
 Flags:                             0x0
 Size of this header:               64 (bytes)
 Size of program headers:           56 (bytes)
 Number of program headers:         9
 Size of section headers:           64 (bytes)
 Number of section headers:         31
 Section header string table index: 30

If you look closely, you'll find Entry point address : 0x400a80. After running objdump on the binary and looking up the given address you'll obtain something this:

0000000000400a80 <_start>:
 400a80:       31 ed                   xor    %ebp,%ebp
 400a82:       49 89 d1                mov    %rdx,%r9
 400a85:       5e                      pop    %rsi
 400a86:       48 89 e2                mov    %rsp,%rdx
 400a89:       48 83 e4 f0             and    $0xfffffffffffffff0,%rsp
 400a8d:       50                      push   %rax
 400a8e:       54                      push   %rsp
 400a8f:       49 c7 c0 c0 48 40 00    mov    $0x4048c0,%r8
 400a96:       48 c7 c1 50 48 40 00    mov    $0x404850,%rcx
 400a9d:       48 c7 c7 70 0b 40 00    mov    $0x400b70,%rdi
 400aa4:       ff 15 1e 85 20 00       callq  *0x20851e(%rip)        # 6  08fc8 <__libc_start_main@GLIBC_2.2.5>
 400aaa:       f4                      hlt    
 400aab:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

This is the _start function that prepares certain parameters/registers before eventually calling main (see the label on the right at address 400aa4 in the example) that contains "your" code. The _start function is usually called after all other sections of the binary have been loaded in memory. After the main is done, the hlt instruction is executed to terminate the execution in this example.

This is what's called entry point. Now, regarding analysis, it has to be started somewhere in the binary, that somewhere is represented using an address (like the entry point). If you want to play with the language/jargon, you can say: analysis entry point rather than binary entry point.

All in all, it's just technical keywords and they have to be defined properly.

Hope this answers your question :)

Answer 3

Entry point is where system loader will start execution of your executable. It's the entrypoint for the Operating system to begin execution in your program.

The analogy could be "main()" function for C/C++ compilers.