Questions tagged [entry-point]

The tag has no usage guidance.

1
vote
1answer
55 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
3
votes
1answer
448 views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
3
votes
3answers
2k views

Start analysis at any position in elf is Entry Point?

An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ?? please help ...
2
votes
1answer
490 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
1
vote
1answer
195 views

Finding out ARC file entry point

I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit ...
2
votes
1answer
2k views

Entry point for STM32 firmware

I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler). The values I try to figure ...
3
votes
3answers
1k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
2
votes
1answer
2k views

How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger. So I loaded an executable process into it. And now I need to know the entry point (or base address) of that loaded executable, the same as I would get from ...
0
votes
1answer
543 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
2
votes
2answers
1k views

how to locate linux kernel module module_init(function), function offset from ELF header?

The header is self explanatory but to explain my self better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the init function. Can i ...
1
vote
1answer
2k views

Reverse Engineer STM32L151's Firmware

I have the STM32L151's firmware that I extracted via JTAG, but I cannot find a start point in IDA. I have tried two methods: 1) I start IDA, drag the binary into the workspace, select ARM Little-...
1
vote
0answers
78 views

Why program opened with OllyDbg 2 isn't paused at start? [duplicate]

There is one thing that I still can’t understand about Olly. I have a sample (an .SCR file) which I’m trying to analyze. When I open it with Olly 1.10, the file is loaded and its execution is paused ...
3
votes
1answer
803 views

Why is this _DllMainCRTStartup calling convention not as expected?

I've been looking around at various DLLs on my computer lately and I thought a decent place to start was the image entry point (typically _DllMainCRTStartup). From what I can see of the CRT source ...
0
votes
1answer
2k views

DLL entry point in memory

I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match ...
1
vote
1answer
1k views

Problem with entry point detection as a file offset

I have found problem with finding file offset which actually is program entry point. In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address. ...
2
votes
1answer
866 views

Why does Olly 2.01 fail to break at the module EP?

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it ...