2

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?

I've found various answers to questions similar to this, but they're answering questions that are far more specific to the OPs use-case. Is there any standard or go-to method for locating the main function when looking at disassembled code?

NOTE: I'm new to disassembly / reverse engineering. If I'm saying something that doesn't quite make sense, all clarification is much appreciated!

  • 1
    You can look at this answer. I guess this will give you some insight about ELF executable format. – perror Oct 30 '18 at 9:48
  • main as int main() or main as the entry point, as can be sseen in ida as start? – Amirag Oct 30 '18 at 16:14
  • If you're looking at disassembled code that does not have any symbols or has been stripped, the main function does not show up. Thus, my question. – xorist Oct 30 '18 at 16:21
2

If the application is a GUI, usually there are 4 arguments that will push to the stack and a call to an address.

Example:

enter image description here

For console application, it has 3 arguments.

Example:

enter image description here

But still, it must be depend upon the compiler. I hope it help you.

  • 1
    So by this, you'd look for a function that takes 3 arguments for a console application in order to find the main function? – xorist Nov 1 '18 at 17:47
  • 1
    @xorist Yes, and you may observed that the main function must be located before the cexit() or ExitProcess(v1) is called. This is the pseudo code produced by IDA Pro. sub_403B20(dword_407004, dword_407000, *v0); cexit(); ExitProcess(v1); – ismael_akez Nov 1 '18 at 18:29
  • I'll try this and let you know how it goes. Thanks! – xorist Nov 2 '18 at 12:29
  • I do have a question, in your images where do you see the number of parameters that are being used? – xorist Nov 2 '18 at 12:30
  • @xorist By looking in the number of values pushed or moved to the stack, eg: mov [esp], xx, mov[exp+4], xx – Fabian Mendez Nov 2 '18 at 20:27

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .