2

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by default during compile time which produce a lot of assembly code, but I actively write only few LOC.

Here is my sample C program created with VS Studio 2017:

void main()
{
    int x = 1;
    int y = 2;
    x = x + y;
}

And this is what I get when I try to disassemble it with Ghidra:

enter image description here

The above screenshot is from the supposed 'entry' point of the program. But why is it so complex? I did a simple program to test how local variables are presented in Assembly and I get such output. Yet it should be few simple Assembly commands instead.

enter image description here

I am not sure what I am missing out here, so if someone could help me to try and understand this, I would be grateful.

2

Program entry point != main

You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) environment.

From Microsoft's CRT Initialization:

By default, the linker includes the CRT library, which provides its own startup code. This startup code initializes the CRT library, calls global initializers, and then calls the user-provided main function for console applications.

From What is the difference between main and mainCRTStartup?:

main() is the entry point of your C or C++ program. mainCRTStartup() is the entrypoint of the C runtime library. It initializes the CRT, calls any static initializers that you wrote in your code, then calls your main() function.

An exercise you may find interesting is compiling the following code (assuming VS Studio 2017 allows it) and then disassembling the resulting binary:

int main(){}

Here is the Linux version: Linux x86 Program Start Up

  • Thank you Julian, a bit clearer now. However, where can I find my main function then? I cannot locate it. – Rebegin Sep 25 at 5:38
  • @Rebegin main should be called at some point by mainCRTStartup. If you're still having a hard time finding it in the disassembly of the program, you can first run the program using a debugger and set a breakpoint at main, look at the call stack, and then revisit the disassembly and decompilation produced by Ghidra – julian Sep 25 at 7:36
  • 1
    Thanks Julian, nice tips. Will do that. I have one other question, but I will open another thread here, because it requires a bit more information. I am essentially trying to learn difference between Global vs Local variables in Assembly. I know the theory that global are stored in Memory, and Local variables are on Stack, but I want to see it with my C code and my disassembly. – Rebegin Sep 25 at 7:56
  • @Rebegin you are welcome – julian Sep 25 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.