So let's say the ELF binary is stripped - meaning no symbol table - and the _start
function doesn't push the address of main before calling __libc_start_main
.
This happened in a binary when compiled for both 32-bit and 64-bit architectures, not sure why sometimes _start
doesn't push the absolute value and instead pushes a register value (if anyone knows please let me know).
Is there any way in this situation that I can generate the call-graph (without names) of the binary starting from main? Is there any way I can find the address of main
? because right now it pushes a register value on the stack and the absolute address of main
doesn't appear in any instruction!
I've added the a sample of the startup routine for a 32 bit version of a simple C program, compiled with gcc with -m32
(the 64 bit version is kinda the same in this section, no absolute address).
I'm not sure why some of my 32 bit programs push the absolute address of main before calling __libc_main_start
and some don`t. Please let me know if you know the answer.
00001070 <_start>:
1070: 31 ed xor ebp,ebp
1072: 5e pop esi
1073: 89 e1 mov ecx,esp
1075: 83 e4 f0 and esp,0xfffffff0
1078: 50 push eax
1079: 54 push esp
107a: 52 push edx
107b: e8 22 00 00 00 call 10a2 <_start+0x32>
1080: 81 c3 80 2f 00 00 add ebx,0x2f80
1086: 8d 83 50 d4 ff ff lea eax,[ebx-0x2bb0]
108c: 50 push eax
108d: 8d 83 f0 d3 ff ff lea eax,[ebx-0x2c10]
1093: 50 push eax
1094: 51 push ecx
1095: 56 push esi
1096: ff b3 f8 ff ff ff push DWORD PTR [ebx-0x8]
109c: e8 9f ff ff ff call 1040 <__libc_start_main@plt>
10a1: f4 hlt
10a2: 8b 1c 24 mov ebx,DWORD PTR [esp]
10a5: c3 ret
10a6: 66 90 xchg ax,ax
10a8: 66 90 xchg ax,ax
10aa: 66 90 xchg ax,ax
10ac: 66 90 xchg ax,ax
10ae: 66 90 xchg ax,ax