I have a problem where I'm instrumenting stripped binaries; I don't know the start of main()
. But there's always an init()
, and init()
calls libc_start_main()
, which receives a pointer to main.
If I can instrument libc with analysis code to intercept the argument, then I can retrieve that address and place another pin callback there so that I can get it's arguments. The problem is, I don't know what the calling convention is; I was thinking, if I could boil this down to a matter of the calling convention, then I do this for any function. I did notice that gdb
knows the calling convention of libc_start_main()
, in fact it is so good, it knows the order of the arguments as well.
I did read a short note on stackoverflow that stated that the name of the function would yield the calling convention: « How to find the calling convention of a third party dll? »
If it's not possible to know the calling convention programmatically, what is the opinion on creating a local build of libc in order to be able to force a particular calling convention onto __libc_start_main()
... you see my chain of thought. Does anybody think that this is a better approach, rather than solving it in the general case ?
main()
function. Meaning that it is probably much more efficient to have a collection of standard initialization functions than trying to solve it in the general case.