0

I am using x64dbg to explore image files on Windows. After the computer finishes prowling ntdll.dll it jumps to OptionalHeader.AddressOfEntryPoint. But this is not my main()-function.

  1. What is this code in my EXE that is not mine?
  2. Can you remove it so there is only my main()-function remaining?
  3. Do you know a way to find the main()-function easily?
1
  • You are looking at CRT initialization. You don't say what toolset you are using but with microsoft tooling, look at the /ENTRY linker flag.
    – josh poley
    Commented Aug 4, 2023 at 17:50

1 Answer 1

1

The code that runs before your main function is the C Runtime (CRT) initialization code. There are ways to remove it, such as via the /NODEFAULTLIB and /ENTRY command-line options to the linker, but be careful what you wish for. If any of your code calls functions in the C standard library (such as printf, malloc, etc.), you will not be able to link your code into a final binary unless you provide your own implementations for those functions. Your implementations must be from scratch; you won't be able to rely upon any standard library functions, or implement them using any third-party library that itself relies upon the standard library. This is not a beginner-friendly task, to put it mildly.

To find the main function in a binary: first, note that tools such as IDA do this automatically. To do it manually, first familiarize yourself with the CRT functions that execute before main, find where it calls main. Then, for any given binary, you can locate the address of main by examining those CRT functions around the locations where they call main.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.