I have newbie question that concerns IDA pro and Visual studio 2010. Basically I started a new "Empty Project" in VS 2010 and added a main function to the .cpp file. Then I compiled it to binary and opened up the binary using IDA Pro. However, I could not locate the main function. Why is that?
4
-
Are you talking about writing an IDA plugin/processor module? If so you should mention which and so on ... your question contains too many unknowns to be answered. Please improve it, otherwise it'll likely get closed.– 0xC0000022L ♦Jan 13, 2014 at 16:04
-
@0xC0000022L: I am not writing anything. I just want to learn how to use IDA to compile a simple binary and practice reading it. It seems more difficult than previously precieved.– MarkJan 13, 2014 at 16:13
-
So you want to use Visual Studio to compile and use IDA to disassemble. Still not enough info, though. You should include information such as what you are building (console/windowed app or DLL) and whether you link to the runtime statically or dynamically. Also, managed or native?– 0xC0000022L ♦Jan 13, 2014 at 17:20
-
@0xC0000022L: I am doing an Empty Project. The setting are all default.– MarkJan 13, 2014 at 17:44
Add a comment
|
3 Answers
Open Exports view in IDA (Views-->Open subviews-->Exports). You'll see there one function name. It is the real main function of the program (which is possibly not your main function, but your main function will be called somehow from it).
Actually you can not find main function by name because this information does not exist in the executable: the computer doesn't need it for program execution. Information about function, variable and type names and relation between CPU instructions and lines of real source code called "debug information" and stored in different place, which is .PDB file in your specific case.
So if you compiled your program with debug information (which is default) loading .PDB file (File-->Load File-->PDB file) will possibly be helpful.
-
So all those functions with names such as subxxxxx are name to identify a function. Does that mean one of them is my main?– MarkJan 13, 2014 at 16:19
-
It should be so. sub_some_hex_address means subroutine at this address, all such names generated automatically.– w sJan 13, 2014 at 16:24
-
If I export a function using __declspec(dllexport) I would be able to find it in the export menu in IDA. However, usually it just show a jump to the Data section and that would be it. It is possible to use this information to locate the real code for the exported function?– MarkJan 13, 2014 at 16:30
-
It looks very strange. As far as I understand dllexport should not generate such code. Did you mean dllimport ?– w sJan 13, 2014 at 16:39
-
I used export for a dll project and export for .exe project. In both cases the function showed up in the export menu of IDA.– MarkJan 13, 2014 at 16:45
start is the address that IDA pulls from the file header. For PE files this corresponds to (AddressOfEntryPoint + ImageBase). start != main, main is language (C/C++) specific requirement, not all languages require "main".
One of the jobs of the code that executes between start and main is to setup all the arguments that main expects (argc, argv, envp) in the manner that main expects to receive them according to the calling conventions of the platform for which the binary was built.
IDA attempts to locate main for you because you are often not interested in the code between start and main which is generally just compiler boiler plate code. In some cases IDA will note that there is a symbol named main and just drop you there. In other cases, IDA does what is effectively signature matching against the start code to pick out the address of main. Compilers tend to have unique ways of reaching main, so if (a big if) IDA has a signature for a specific compiler, then it may be able to pick main out for you.
You don't mention whether you are using IDA on the Debug or Release version of your binary. In my experience with IDA/Visual Studio, IDA will have a tough time finding main on Debug builds and does a better job on Release builds. If you compare the two different .exe files, you will see that they are vastly different. Specifically flow through Debug builds is much more complicated than through Release builds.
In IDA, view 'functions' and look for 'start'.
See anything?
Sometimes the IDA signatures can't identify the main() function. In this case, you will have to trace it manually from the program's Entry Point, though the sigs have improved over the years, they usually are able to identify main correctly.
How you get to main() also depends also on whether you are linking to the standard Visual Studios libraries or not (I can't remember if the Empty Project does by default or not).
-
The entry point should be the main function right? If that is the case is the start function the main?– MarkJan 13, 2014 at 3:33
-
The entry point is not always the main function, no. The compiler usually has some code that it runs before and after main(). One example is the initialization/construction of static globals. Jan 13, 2014 at 5:14
-
I don't have IDA handy, someone can correct me please if I'm wrong but I think from memory that 'start' should point to what IDA identifies as the 'main' function, i.e IDA tries to skip the autogenerated code around the user code, since it knows that most researchers are more interested in user code rather than standard library code. Jan 13, 2014 at 5:17