1

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows how to do this in IDA I have the free version of IDA 5.0.

root@kali:~/Desktop# objdump -d dbgLab.bin 

dbgLab.bin:     file format elf32-i386


Disassembly of section .init:

08048374 <.init>:
 8048374:   53                      push   %ebx
 8048375:   83 ec 08                sub    $0x8,%esp
 8048378:   e8 00 00 00 00          call   804837d <printf@plt-0x43>
 804837d:   5b                      pop    %ebx
 804837e:   81 c3 77 1c 00 00       add    $0x1c77,%ebx
 8048384:   8b 83 fc ff ff ff       mov    -0x4(%ebx),%eax
 804838a:   85 c0                   test   %eax,%eax
 804838c:   74 05                   je     8048393 <printf@plt-0x2d>
 804838e:   e8 5d 00 00 00          call   80483f0 <__gmon_start__@plt>
 8048393:   e8 48 01 00 00          call   80484e0 <strncmp@plt+0xa0>
 8048398:   e8 13 03 00 00          call   80486b0 <strncmp@plt+0x270>
 804839d:   83 c4 08                add    $0x8,%esp
 80483a0:   5b                      pop    %ebx
 80483a1:   c3                      ret    

Disassembly of section .plt:

080483b0 <printf@plt-0x10>:
 80483b0:   ff 35 f8 9f 04 08       pushl  0x8049ff8
 80483b6:   ff 25 fc 9f 04 08       jmp    *0x8049ffc
 80483bc:   00 00                   add    %al,(%eax)
    ...

080483c0 <printf@plt>:
 80483c0:   ff 25 00 a0 04 08       jmp    *0x804a000
 80483c6:   68 00 00 00 00          push   $0x0
 80483cb:   e9 e0 ff ff ff          jmp    80483b0 <printf@plt-0x10>

080483d0 <malloc@plt>:
 80483d0:   ff 25 04 a0 04 08       jmp    *0x804a004
 80483d6:   68 08 00 00 00          push   $0x8
 80483db:   e9 d0 ff ff ff          jmp    80483b0 <printf@plt-0x10>

080483e0 <puts@plt>:
 80483e0:   ff 25 08 a0 04 08       jmp    *0x804a008
 80483e6:   68 10 00 00 00          push   $0x10
 80483eb:   e9 c0 ff ff ff          jmp    80483b0 <printf@plt-0x10>

080483f0 <__gmon_start__@plt>:
 80483f0:   ff 25 0c a0 04 08       jmp    *0x804a00c
 80483f6:   68 18 00 00 00          push   $0x18
 80483fb:   e9 b0 ff ff ff          jmp    80483b0 <printf@plt-0x10>

08048400 <exit@plt>:
 8048400:   ff 25 10 a0 04 08       jmp    *0x804a010
 8048406:   68 20 00 00 00          push   $0x20
 804840b:   e9 a0 ff ff ff          jmp    80483b0 <printf@plt-0x10>

08048410 <__libc_start_main@plt>:
 8048410:   ff 25 14 a0 04 08       jmp    *0x804a014
 8048416:   68 28 00 00 00          push   $0x28
 804841b:   e9 90 ff ff ff          jmp    80483b0 <printf@plt-0x10>

08048420 <strncpy@plt>:
 8048420:   ff 25 18 a0 04 08       jmp    *0x804a018
 8048426:   68 30 00 00 00          push   $0x30
 804842b:   e9 80 ff ff ff          jmp    80483b0 <printf@plt-0x10>

08048430 <atoi@plt>:
 8048430:   ff 25 1c a0 04 08       jmp    *0x804a01c
 8048436:   68 38 00 00 00          push   $0x38
 804843b:   e9 70 ff ff ff          jmp    80483b0 <printf@plt-0x10>

08048440 <strncmp@plt>:
 8048440:   ff 25 20 a0 04 08       jmp    *0x804a020
 8048446:   68 40 00 00 00          push   $0x40
 804844b:   e9 60 ff ff ff          jmp    80483b0 <printf@plt-0x10>

Disassembly of section .text:

08048450 <.text>:
 8048450:   31 ed                   xor    %ebp,%ebp
 8048452:   5e                      pop    %esi
 8048453:   89 e1                   mov    %esp,%ecx
 8048455:   83 e4 f0                and    $0xfffffff0,%esp
 8048458:   50                      push   %eax
 8048459:   54                      push   %esp
 804845a:   52                      push   %edx
 804845b:   68 a0 86 04 08          push   $0x80486a0
 8048460:   68 30 86 04 08          push   $0x8048630
 8048465:   51                      push   %ecx
 8048466:   56                      push   %esi
 8048467:   68 3e 85 04 08          push   $0x804853e
 804846c:   e8 9f ff ff ff          call   8048410 <__libc_start_main@plt>
 8048471:   f4                      hlt    
 8048472:   90                      nop
 8048473:   90                      nop
 8048474:   90                      nop
 8048475:   90                      nop
 8048476:   90                      nop
 8048477:   90                      nop
 8048478:   90                      nop
 8048479:   90                      nop
 804847a:   90                      nop
 804847b:   90                      nop
 804847c:   90                      nop
 804847d:   90                      nop
 804847e:   90                      nop
 804847f:   90                      nop
 8048480:   55                      push   %ebp
 8048481:   89 e5                   mov    %esp,%ebp
 8048483:   53                      push   %ebx
 8048484:   83 ec 04                sub    $0x4,%esp
 8048487:   80 3d 44 a0 04 08 00    cmpb   $0x0,0x804a044
 804848e:   75 3f                   jne    80484cf <strncmp@plt+0x8f>
 8048490:   a1 48 a0 04 08          mov    0x804a048,%eax
 8048495:   bb 20 9f 04 08          mov    $0x8049f20,%ebx
 804849a:   81 eb 1c 9f 04 08       sub    $0x8049f1c,%ebx
 80484a0:   c1 fb 02                sar    $0x2,%ebx
 80484a3:   83 eb 01                sub    $0x1,%ebx
 80484a6:   39 d8                   cmp    %ebx,%eax
 80484a8:   73 1e                   jae    80484c8 <strncmp@plt+0x88>
 80484aa:   8d b6 00 00 00 00       lea    0x0(%esi),%esi
 80484b0:   83 c0 01                add    $0x1,%eax
 80484b3:   a3 48 a0 04 08          mov    %eax,0x804a048
 80484b8:   ff 14 85 1c 9f 04 08    call   *0x8049f1c(,%eax,4)
 80484bf:   a1 48 a0 04 08          mov    0x804a048,%eax
 80484c4:   39 d8                   cmp    %ebx,%eax
 80484c6:   72 e8                   jb     80484b0 <strncmp@plt+0x70>
 80484c8:   c6 05 44 a0 04 08 01    movb   $0x1,0x804a044
 80484cf:   83 c4 04                add    $0x4,%esp
 80484d2:   5b                      pop    %ebx
 80484d3:   5d                      pop    %ebp
 80484d4:   c3                      ret    
 80484d5:   8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
 80484d9:   8d bc 27 00 00 00 00    lea    0x0(%edi,%eiz,1),%edi
 80484e0:   55                      push   %ebp
 80484e1:   89 e5                   mov    %esp,%ebp
 80484e3:   83 ec 18                sub    $0x18,%esp
 80484e6:   a1 24 9f 04 08          mov    0x8049f24,%eax
 80484eb:   85 c0                   test   %eax,%eax
 80484ed:   74 12                   je     8048501 <strncmp@plt+0xc1>
 80484ef:   b8 00 00 00 00          mov    $0x0,%eax
 80484f4:   85 c0                   test   %eax,%eax
 80484f6:   74 09                   je     8048501 <strncmp@plt+0xc1>
 80484f8:   c7 04 24 24 9f 04 08    movl   $0x8049f24,(%esp)
 80484ff:   ff d0                   call   *%eax
 8048501:   c9                      leave  
 8048502:   c3                      ret    
 8048503:   90                      nop
 8048504:   55                      push   %ebp
 8048505:   89 e5                   mov    %esp,%ebp
 8048507:   83 ec 14                sub    $0x14,%esp
 804850a:   8b 45 08                mov    0x8(%ebp),%eax
 804850d:   88 45 ec                mov    %al,-0x14(%ebp)
 8048510:   c7 45 fc 00 00 00 00    movl   $0x0,-0x4(%ebp)
 8048517:   eb 1b                   jmp    8048534 <strncmp@plt+0xf4>
 8048519:   8b 45 fc                mov    -0x4(%ebp),%eax
 804851c:   03 45 0c                add    0xc(%ebp),%eax
 804851f:   8b 55 fc                mov    -0x4(%ebp),%edx
 8048522:   03 55 0c                add    0xc(%ebp),%edx
 8048525:   0f b6 0a                movzbl (%edx),%ecx
 8048528:   0f b6 55 ec             movzbl -0x14(%ebp),%edx
 804852c:   31 ca                   xor    %ecx,%edx
 804852e:   88 10                   mov    %dl,(%eax)
 8048530:   83 45 fc 01             addl   $0x1,-0x4(%ebp)
 8048534:   8b 45 fc                mov    -0x4(%ebp),%eax
 8048537:   3b 45 10                cmp    0x10(%ebp),%eax
 804853a:   7c dd                   jl     8048519 <strncmp@plt+0xd9>
 804853c:   c9                      leave  
 804853d:   c3                      ret    
 804853e:   55                      push   %ebp
 804853f:   89 e5                   mov    %esp,%ebp
 8048541:   83 e4 f0                and    $0xfffffff0,%esp
 8048544:   83 ec 20                sub    $0x20,%esp
 8048547:   c6 44 24 1f cf          movb   $0xcf,0x1f(%esp)
 804854c:   c7 04 24 0d 00 00 00    movl   $0xd,(%esp)
 8048553:   e8 78 fe ff ff          call   80483d0 <malloc@plt>
 8048558:   89 44 24 18             mov    %eax,0x18(%esp)
 804855c:   83 7d 08 02             cmpl   $0x2,0x8(%ebp)
 8048560:   7f 0c                   jg     804856e <strncmp@plt+0x12e>
 8048562:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)
 8048569:   e8 92 fe ff ff          call   8048400 <exit@plt>
 804856e:   8b 45 0c                mov    0xc(%ebp),%eax
 8048571:   83 c0 04                add    $0x4,%eax
 8048574:   8b 00                   mov    (%eax),%eax
 8048576:   c7 44 24 08 0d 00 00    movl   $0xd,0x8(%esp)
 804857d:   00 
 804857e:   89 44 24 04             mov    %eax,0x4(%esp)
 8048582:   8b 44 24 18             mov    0x18(%esp),%eax
 8048586:   89 04 24                mov    %eax,(%esp)
 8048589:   e8 92 fe ff ff          call   8048420 <strncpy@plt>
 804858e:   0f b6 44 24 1f          movzbl 0x1f(%esp),%eax
 8048593:   c7 44 24 08 0c 00 00    movl   $0xc,0x8(%esp)
 804859a:   00 
 804859b:   c7 44 24 04 30 a0 04    movl   $0x804a030,0x4(%esp)
 80485a2:   08 
 80485a3:   89 04 24                mov    %eax,(%esp)
 80485a6:   e8 59 ff ff ff          call   8048504 <strncmp@plt+0xc4>
 80485ab:   c7 44 24 08 14 00 00    movl   $0x14,0x8(%esp)
 80485b2:   00 
 80485b3:   8b 44 24 18             mov    0x18(%esp),%eax
 80485b7:   89 44 24 04             mov    %eax,0x4(%esp)
 80485bb:   c7 04 24 30 a0 04 08    movl   $0x804a030,(%esp)
 80485c2:   e8 79 fe ff ff          call   8048440 <strncmp@plt>
 80485c7:   85 c0                   test   %eax,%eax
 80485c9:   74 21                   je     80485ec <strncmp@plt+0x1ac>
 80485cb:   b8 08 87 04 08          mov    $0x8048708,%eax
 80485d0:   c7 44 24 04 30 a0 04    movl   $0x804a030,0x4(%esp)
 80485d7:   08 
 80485d8:   89 04 24                mov    %eax,(%esp)
 80485db:   e8 e0 fd ff ff          call   80483c0 <printf@plt>
 80485e0:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)
 80485e7:   e8 14 fe ff ff          call   8048400 <exit@plt>
 80485ec:   8b 45 0c                mov    0xc(%ebp),%eax
 80485ef:   83 c0 08                add    $0x8,%eax
 80485f2:   8b 00                   mov    (%eax),%eax
 80485f4:   89 04 24                mov    %eax,(%esp)
 80485f7:   e8 34 fe ff ff          call   8048430 <atoi@plt>
 80485fc:   8b 15 40 a0 04 08       mov    0x804a040,%edx
 8048602:   39 d0                   cmp    %edx,%eax
 8048604:   74 18                   je     804861e <strncmp@plt+0x1de>
 8048606:   c7 04 24 16 87 04 08    movl   $0x8048716,(%esp)
 804860d:   e8 ce fd ff ff          call   80483e0 <puts@plt>
 8048612:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)
 8048619:   e8 e2 fd ff ff          call   8048400 <exit@plt>
 804861e:   c7 04 24 1b 87 04 08    movl   $0x804871b,(%esp)
 8048625:   e8 b6 fd ff ff          call   80483e0 <puts@plt>
 804862a:   c9                      leave  
 804862b:   c3                      ret    
 804862c:   90                      nop
 804862d:   90                      nop
 804862e:   90                      nop
 804862f:   90                      nop
 8048630:   55                      push   %ebp
 8048631:   57                      push   %edi
 8048632:   56                      push   %esi
 8048633:   53                      push   %ebx
 8048634:   e8 69 00 00 00          call   80486a2 <strncmp@plt+0x262>
 8048639:   81 c3 bb 19 00 00       add    $0x19bb,%ebx
 804863f:   83 ec 1c                sub    $0x1c,%esp
 8048642:   8b 6c 24 30             mov    0x30(%esp),%ebp
 8048646:   8d bb 20 ff ff ff       lea    -0xe0(%ebx),%edi
 804864c:   e8 23 fd ff ff          call   8048374 <printf@plt-0x4c>
 8048651:   8d 83 20 ff ff ff       lea    -0xe0(%ebx),%eax
 8048657:   29 c7                   sub    %eax,%edi
 8048659:   c1 ff 02                sar    $0x2,%edi
 804865c:   85 ff                   test   %edi,%edi
 804865e:   74 29                   je     8048689 <strncmp@plt+0x249>
 8048660:   31 f6                   xor    %esi,%esi
 8048662:   8d b6 00 00 00 00       lea    0x0(%esi),%esi
 8048668:   8b 44 24 38             mov    0x38(%esp),%eax
 804866c:   89 2c 24                mov    %ebp,(%esp)
 804866f:   89 44 24 08             mov    %eax,0x8(%esp)
 8048673:   8b 44 24 34             mov    0x34(%esp),%eax
 8048677:   89 44 24 04             mov    %eax,0x4(%esp)
 804867b:   ff 94 b3 20 ff ff ff    call   *-0xe0(%ebx,%esi,4)
 8048682:   83 c6 01                add    $0x1,%esi
 8048685:   39 fe                   cmp    %edi,%esi
 8048687:   75 df                   jne    8048668 <strncmp@plt+0x228>
 8048689:   83 c4 1c                add    $0x1c,%esp
 804868c:   5b                      pop    %ebx
 804868d:   5e                      pop    %esi
 804868e:   5f                      pop    %edi
 804868f:   5d                      pop    %ebp
 8048690:   c3                      ret    
 8048691:   eb 0d                   jmp    80486a0 <strncmp@plt+0x260>
 8048693:   90                      nop
 8048694:   90                      nop
 8048695:   90                      nop
 8048696:   90                      nop
 8048697:   90                      nop
 8048698:   90                      nop
 8048699:   90                      nop
 804869a:   90                      nop
 804869b:   90                      nop
 804869c:   90                      nop
 804869d:   90                      nop
 804869e:   90                      nop
 804869f:   90                      nop
 80486a0:   f3 c3                   repz ret 
 80486a2:   8b 1c 24                mov    (%esp),%ebx
 80486a5:   c3                      ret    
 80486a6:   90                      nop
 80486a7:   90                      nop
 80486a8:   90                      nop
 80486a9:   90                      nop
 80486aa:   90                      nop
 80486ab:   90                      nop
 80486ac:   90                      nop
 80486ad:   90                      nop
 80486ae:   90                      nop
 80486af:   90                      nop
 80486b0:   55                      push   %ebp
 80486b1:   89 e5                   mov    %esp,%ebp
 80486b3:   53                      push   %ebx
 80486b4:   83 ec 04                sub    $0x4,%esp
 80486b7:   a1 14 9f 04 08          mov    0x8049f14,%eax
 80486bc:   83 f8 ff                cmp    $0xffffffff,%eax
 80486bf:   74 13                   je     80486d4 <strncmp@plt+0x294>
 80486c1:   bb 14 9f 04 08          mov    $0x8049f14,%ebx
 80486c6:   66 90                   xchg   %ax,%ax
 80486c8:   83 eb 04                sub    $0x4,%ebx
 80486cb:   ff d0                   call   *%eax
 80486cd:   8b 03                   mov    (%ebx),%eax
 80486cf:   83 f8 ff                cmp    $0xffffffff,%eax
 80486d2:   75 f4                   jne    80486c8 <strncmp@plt+0x288>
 80486d4:   83 c4 04                add    $0x4,%esp
 80486d7:   5b                      pop    %ebx
 80486d8:   5d                      pop    %ebp
 80486d9:   c3                      ret    
 80486da:   90                      nop
 80486db:   90                      nop

Disassembly of section .fini:

080486dc <.fini>:
 80486dc:   53                      push   %ebx
 80486dd:   83 ec 08                sub    $0x8,%esp
 80486e0:   e8 00 00 00 00          call   80486e5 <strncmp@plt+0x2a5>
 80486e5:   5b                      pop    %ebx
 80486e6:   81 c3 0f 19 00 00       add    $0x190f,%ebx
 80486ec:   e8 8f fd ff ff          call   8048480 <strncmp@plt+0x40>
 80486f1:   83 c4 08                add    $0x8,%esp
 80486f4:   5b                      pop    %ebx
 80486f5:   c3                      ret 

2 Answers 2

4

Address of main is the first argument to the __libc_start_main function. Let's look at the entrypoint code:

 xor    %ebp,%ebp
 pop    %esi
 mov    %esp,%ecx
 and    $0xfffffff0,%esp
 push   %eax
 push   %esp
 push   %edx
 push   $0x80486a0
 push   $0x8048630
 push   %ecx
 push   %esi
 push   $0x804853e
 call   8048410 <__libc_start_main@plt>
 hlt    

Since it's x86 code, it uses cdecl ABI, which means the first argument is pushed last onto the stack. So the address of main is 0x804853e.

1
  • I'd like to point out that this works if the program implements a C-like main function. Unfortunately, some programs don't and all you have is the entry point.
    – yaspr
    Commented Apr 28, 2014 at 9:11
2

Well, from the objdump listing you provided it's pretty obvious that this binary file has been stripped out of all symbols. This is why you won't be able to find the main symbol or any other function's symbol but those originating from an external library. But, given that this binary file is an ELF, you can run the readelf -h command on it and get the Entry point address which will certainly point to the .text section located at address 08048450 in your binary's objdump listing.

If you'd like more information on how to find the main function, the answers of this post & this post cover most of what you need to know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.