for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?

I've found various answers to questions similar to this, but they're answering questions that are far more specific to the OPs use-case. Is there any standard or go-to method for locating the main function when looking at disassembled code?

NOTE: I'm new to disassembly / reverse engineering. If I'm saying something that doesn't quite make sense, all clarification is much appreciated!

  • 2
    You can look at this answer. I guess this will give you some insight about ELF executable format.
    – perror
    Oct 30 '18 at 9:48
  • main as int main() or main as the entry point, as can be sseen in ida as start?
    – Frowner
    Oct 30 '18 at 16:14
  • If you're looking at disassembled code that does not have any symbols or has been stripped, the main function does not show up. Thus, my question.
    – xorist
    Oct 30 '18 at 16:21

If the application is a GUI, usually there are 4 arguments that will push to the stack and a call to an address.


enter image description here

For console application, it has 3 arguments.


enter image description here

But still, it must be depend upon the compiler. I hope it help you.

  • 1
    So by this, you'd look for a function that takes 3 arguments for a console application in order to find the main function?
    – xorist
    Nov 1 '18 at 17:47
  • 1
    @xorist Yes, and you may observed that the main function must be located before the cexit() or ExitProcess(v1) is called. This is the pseudo code produced by IDA Pro. sub_403B20(dword_407004, dword_407000, *v0); cexit(); ExitProcess(v1); Nov 1 '18 at 18:29
  • I'll try this and let you know how it goes. Thanks!
    – xorist
    Nov 2 '18 at 12:29
  • I do have a question, in your images where do you see the number of parameters that are being used?
    – xorist
    Nov 2 '18 at 12:30
  • @xorist By looking in the number of values pushed or moved to the stack, eg: mov [esp], xx, mov[exp+4], xx Nov 2 '18 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.