1

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?

I've found various answers to questions similar to this, but they're answering questions that are far more specific to the OPs use-case. I often see that searching for three (console) or four (GUI) pushes somewhere within the CRT libraries is recommended, but this sometimes is too weak of an indication for me (envp is optional, weird startup wrapping libraries, etc.)

Are there any more solid ways to look for the main(), WinMain or DllMain() functions in Windows PE files?

Improve this question
2
  • I see your question is related to reverseengineering.stackexchange.com/questions/19754/… but I agree it is different because you're asking for a stronger heuristic than was given there.
    – dingo_kinznerhook
    Aug 24, 2022 at 15:55
  • I doubt you will find an answer to this that works in every circumstance, hence the reason you always find answers that are specific to the use case. If you can generate another program using the same compiler and startup wrapping libraries as your RE target, look at how you can identify main() on that program and see if you can identify some pattern that will reliably point you to main(). Sorry if that's not much help.
    – dingo_kinznerhook
    Aug 24, 2022 at 16:15

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.