So basically I am working on some tripped dynamic linked ELF binaries (32 bit Linux x86), using
objdump to disassemble them, modifying and trying to reassemble them.
In the unstripped binary, we can get the beginning address of main function based on the symbol table, however, on the stripped binary, we just don't know where the main function is.
Of course I can just adjust the whole text section, and starting from the original entry point of the ELF.
But the problems are:
There is some control transfer from the prologue/epilog of this ELF (such as
__do_global_ctors_aux) into the
.ctorssection, which means I have to also disassemble this section.
I am afraid that if I start from entry point in the re-assembled ELF, then I would probably double-init some stuff, because in my re-assembled asm code, I have the code of
__libc_csu_finiwhile linker will also attach these functions in the new ELF.
So I would like to use some way to identify the
main function in a stripped ELF (heuristically)...
Right now I don't have some strategies on this issue, Could anyone give me some help?