3

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?

I've found various answers to questions similar to this, but they're answering questions that are far more specific to the OPs use-case. Is there any standard or go-to method for locating the main function when looking at disassembled code?

NOTE: I'm new to disassembly / reverse engineering. If I'm saying something that doesn't quite make sense, all clarification is much appreciated!

Improve this question
3
  • 2
    You can look at this answer. I guess this will give you some insight about ELF executable format.
    – perror
    Commented Oct 30, 2018 at 9:48
  • main as int main() or main as the entry point, as can be sseen in ida as start?
    – user22970
    Commented Oct 30, 2018 at 16:14
  • If you're looking at disassembled code that does not have any symbols or has been stripped, the main function does not show up. Thus, my question.
    – xorist
    Commented Oct 30, 2018 at 16:21

1 Answer 1

Reset to default
2

If the application is a GUI, usually there are 4 arguments that will push to the stack and a call to an address.

Example:

enter image description here

For console application, it has 3 arguments.

Example:

enter image description here

But still, it must be depend upon the compiler. I hope it help you.

Improve this answer
6
  • 1
    So by this, you'd look for a function that takes 3 arguments for a console application in order to find the main function?
    – xorist
    Commented Nov 1, 2018 at 17:47
  • 1
    @xorist Yes, and you may observed that the main function must be located before the cexit() or ExitProcess(v1) is called. This is the pseudo code produced by IDA Pro. sub_403B20(dword_407004, dword_407000, *v0); cexit(); ExitProcess(v1);
    – ismael_akez
    Commented Nov 1, 2018 at 18:29
  • I'll try this and let you know how it goes. Thanks!
    – xorist
    Commented Nov 2, 2018 at 12:29
  • I do have a question, in your images where do you see the number of parameters that are being used?
    – xorist
    Commented Nov 2, 2018 at 12:30
  • @xorist By looking in the number of values pushed or moved to the stack, eg: mov [esp], xx, mov[exp+4], xx
    – Fabian Mendez
    Commented Nov 2, 2018 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.