main function not found in GCC compiled code

Question

I'm trying to learn reverse engineering using Radare2. For this I compiled a hello world program with GCC on Ubuntu (version: gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0).

#include <stdio.h>
int main() {
        printf("Hello, world!");
        return 0;
}

Compile it:

gcc -w hello_world.c -o hello_world

However, when I decompile it using Radare2:

r2 hello_world
[0x00001060]> aaa
[Cannot find function at 0x00001060 sym. and entry0 (aa)
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform additional experimental analysis.
[0x00001060]> afl
0x00001090    4 41   -> 34   sym.deregister_tm_clones
0x000010c0    4 57   -> 51   sym.register_tm_clones
[0x00001060]> 

The main function does not show up. Searching for it specifically with pdf @main also does not work.

But the program runs fine, and other information I get using Radare (iI command for example) looks normal.

Can anyone explain to me why I can't get the main function to show?

Edit: I tried the same thing on Ubuntu 18.04 LTS and I get a different output, this time with the main function

[0x7f1465cb4090]> afl
0x55595d978000    2 64           sym.imp.__libc_start_main
0x55595d9784f0    3 23           sym._init
0x55595d978520    1 6            sym.imp.printf
0x55595d978530    1 6            sub.__cxa_finalize_248_530
0x55595d978540    1 43           entry0
0x55595d978570    4 50   -> 40   sym.deregister_tm_clones
0x55595d9785b0    4 66   -> 57   sym.register_tm_clones
0x55595d978600    4 49           sym.__do_global_dtors_aux
0x55595d978640    1 10           entry1.init
0x55595d97864a    1 28           sym.main
0x55595d978670    4 101          sym.__libc_csu_init
0x55595d9786e0    1 2            sym.__libc_csu_fini
0x55595d9786e4    1 9            sym._fini
0x55595db78fe0    1 1020         reloc.__libc_start_main_224

Answer 1

This is because of your old radare2 installation. If you installed radare2 via apt its very old. Build it from latest source instead and you can look at different symbols.

I tried to replicate your problem in an Ubuntu 20.04 docker container

root@4a6deaf68cd8:/tmp# r2 -v
radare2 4.2.1 0 @ linux-x86-64 git.4.2.1
commit: unknown build: 
root@4a6deaf68cd8:/tmp# r2 -q -c "aaa; afl" hello_world
Cannot find function at 0x00001060
0x00001090    4 41   -> 34   sym.deregister_tm_clones
0x000010c0    4 57   -> 51   sym.register_tm_clones
root@4a6deaf68cd8:/tmp# /root/bin/r2 -v
radare2 5.1.0 25622 @ linux-x86-64 git.5.1.0
commit: 0939e57001c9eeda296d2699c60b967b5927e637 build: 2021-01-26__20:17:25
root@4a6deaf68cd8:/tmp# /root/bin/r2 -q -c "aaa; afl" hello_world
Warning: run r2 with -e io.cache=true to fix relocations in disassembly
0x00001060    1 46           entry0
0x00001090    4 41   -> 34   sym.deregister_tm_clones
0x000010c0    4 57   -> 51   sym.register_tm_clones
0x00001100    5 57   -> 54   sym.__do_global_dtors_aux
0x00001040    1 11           sym..plt.got
0x00001140    1 9            entry.init0
0x00001000    3 27           sym._init
0x000011e0    1 5            sym.__libc_csu_fini
0x000011e8    1 13           sym._fini
0x00001170    4 101          sym.__libc_csu_init
0x00001149    1 32           main
0x00001050    1 11           sym.imp.printf
root@4a6deaf68cd8:/tmp# 

I used the sys/user.sh in r2's repo to build from source and install new r2 at /root/bin/r2

In the output - the latest radare2 was able to figure out main and some other functions while the older one could not.