I'v try to debugging windows PE file under Linux.

winedbg --gdb --no-start a.exe                                                  ─╯
00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @0x4014c0 (83456<1315>)
00bc:00c0: create thread I @0x4014c0
target remote localhost:59889

And use radare2 to connect to it.

r2 -e dbg.exe.path=./a.exe -d gdb://localhost:59889                             ─╯
= attach 192 1
= attach 192 0
WARNING: (dwarf_process.c:902):map_dwarf_reg_to_x86_reg: code should not be reached
 -- Don't wait for Travis
[0x000015e0]> pd 3
            ;-- main:
            ;-- _main:
            0x000015e0      ff             invalid
            0x000015e1      ff             invalid
            0x000015e2      ff             invalid

Why there's nothing in main funtion?

I have used 'aaa' to analyze.

But when I use 'dc', the program runs correctly.

How to fix it?

  • It's been a while but I seem to recall windows programs don't typically have a main() rather they're an event loop called by the OS. Try looking at an example of how to make one; even better, build it and reverse engineer that. – Chris Stratton Sep 10 '20 at 21:52
  • I can see main function and instructions in main in IDA, I can't see it only when using winedbg and r2, maybe it's a bug. – coolder Sep 11 '20 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.