So let's say the ELF binary is stripped - meaning no symbol table - and the
_start function doesn't push the address of main before calling
This happened in a binary when compiled for both 32-bit and 64-bit architectures, not sure why sometimes
_start doesn't push the absolute value and instead pushes a register value (if anyone knows please let me know).
Is there any way in this situation that I can generate the call-graph (without names) of the binary starting from main? Is there any way I can find the address of
main? because right now it pushes a register value on the stack and the absolute address of
main doesn't appear in any instruction!
I've added the a sample of the startup routine for a 32 bit version of a simple C program, compiled with gcc with
-m32 (the 64 bit version is kinda the same in this section, no absolute address).
I'm not sure why some of my 32 bit programs push the absolute address of main before calling
__libc_main_start and some don`t. Please let me know if you know the answer.
00001070 <_start>: 1070: 31 ed xor ebp,ebp 1072: 5e pop esi 1073: 89 e1 mov ecx,esp 1075: 83 e4 f0 and esp,0xfffffff0 1078: 50 push eax 1079: 54 push esp 107a: 52 push edx 107b: e8 22 00 00 00 call 10a2 <_start+0x32> 1080: 81 c3 80 2f 00 00 add ebx,0x2f80 1086: 8d 83 50 d4 ff ff lea eax,[ebx-0x2bb0] 108c: 50 push eax 108d: 8d 83 f0 d3 ff ff lea eax,[ebx-0x2c10] 1093: 50 push eax 1094: 51 push ecx 1095: 56 push esi 1096: ff b3 f8 ff ff ff push DWORD PTR [ebx-0x8] 109c: e8 9f ff ff ff call 1040 <__libc_start_main@plt> 10a1: f4 hlt 10a2: 8b 1c 24 mov ebx,DWORD PTR [esp] 10a5: c3 ret 10a6: 66 90 xchg ax,ax 10a8: 66 90 xchg ax,ax 10aa: 66 90 xchg ax,ax 10ac: 66 90 xchg ax,ax 10ae: 66 90 xchg ax,ax