0

I'm trying to learn reverse engineering using Radare2. For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0).

#include <stdio.h>
int main() {
        printf("Hello, world!");
        return 0;
}

Compile it:

gcc -w hello_world.c -o hello_world

However, when I decompile it using Radare2:

r2 hello_world
[0x00001060]> aaa
[Cannot find function at 0x00001060 sym. and entry0 (aa)
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform additional experimental analysis.
[0x00001060]> afl
0x00001090    4 41   -> 34   sym.deregister_tm_clones
0x000010c0    4 57   -> 51   sym.register_tm_clones
[0x00001060]> 

The main function does not show up. Searching for it specifically with pdf @main also does not work.

But the program runs fine, and other information I get using Radare (iI command for example) looks normal.

Can anyone explain to me why I can't get the main function to show?

Edit: I tried the same thing on Ubuntu 18.04 LTS and I get a different output, this time with the main function

[0x7f1465cb4090]> afl
0x55595d978000    2 64           sym.imp.__libc_start_main
0x55595d9784f0    3 23           sym._init
0x55595d978520    1 6            sym.imp.printf
0x55595d978530    1 6            sub.__cxa_finalize_248_530
0x55595d978540    1 43           entry0
0x55595d978570    4 50   -> 40   sym.deregister_tm_clones
0x55595d9785b0    4 66   -> 57   sym.register_tm_clones
0x55595d978600    4 49           sym.__do_global_dtors_aux
0x55595d978640    1 10           entry1.init
0x55595d97864a    1 28           sym.main
0x55595d978670    4 101          sym.__libc_csu_init
0x55595d9786e0    1 2            sym.__libc_csu_fini
0x55595d9786e4    1 9            sym._fini
0x55595db78fe0    1 1020         reloc.__libc_start_main_224
7
  • 3
    any specific compile flags? When I repro your case I get main and everything else as expected. Jan 25 at 21:25
  • I used GCC -w hello_world.c -o hello_world
    – martsc1
    Jan 26 at 8:03
  • 1
    It should compile with symbols by default. There should be an entry in the symbol table for main()
    – julian
    Jan 26 at 10:44
  • @martsc1 well, GCC isn't typically called with a binary called GCC, but instead with an all-lowercase gcc as driver. So do you mind telling us what's going on behind the scenes here? If you're on Bash, for example, provide the output of type GCC.
    – 0xC0000022L
    Jan 26 at 11:45
  • I don't know why I typed that command in caps, I used it in lower case 'gcc -w hello_world.c -o hello_world'. Sorry for the confusion! I also tried using the debug flags -g,-Og,-g3 but none of them solved the issue.
    – martsc1
    Jan 26 at 12:01
1

This is because of your old radare2 installation. If you installed radare2 via apt its very old. Build it from latest source instead and you can look at different symbols.

I tried to replicate your problem in an Ubuntu 20.04 docker container

root@4a6deaf68cd8:/tmp# r2 -v
radare2 4.2.1 0 @ linux-x86-64 git.4.2.1
commit: unknown build: 
root@4a6deaf68cd8:/tmp# r2 -q -c "aaa; afl" hello_world
Cannot find function at 0x00001060
0x00001090    4 41   -> 34   sym.deregister_tm_clones
0x000010c0    4 57   -> 51   sym.register_tm_clones
root@4a6deaf68cd8:/tmp# /root/bin/r2 -v
radare2 5.1.0 25622 @ linux-x86-64 git.5.1.0
commit: 0939e57001c9eeda296d2699c60b967b5927e637 build: 2021-01-26__20:17:25
root@4a6deaf68cd8:/tmp# /root/bin/r2 -q -c "aaa; afl" hello_world
Warning: run r2 with -e io.cache=true to fix relocations in disassembly
0x00001060    1 46           entry0
0x00001090    4 41   -> 34   sym.deregister_tm_clones
0x000010c0    4 57   -> 51   sym.register_tm_clones
0x00001100    5 57   -> 54   sym.__do_global_dtors_aux
0x00001040    1 11           sym..plt.got
0x00001140    1 9            entry.init0
0x00001000    3 27           sym._init
0x000011e0    1 5            sym.__libc_csu_fini
0x000011e8    1 13           sym._fini
0x00001170    4 101          sym.__libc_csu_init
0x00001149    1 32           main
0x00001050    1 11           sym.imp.printf
root@4a6deaf68cd8:/tmp# 

I used the sys/user.sh in r2's repo to build from source and install new r2 at /root/bin/r2

In the output - the latest radare2 was able to figure out main and some other functions while the older one could not.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.