Questions tagged [entry-point]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
3answers
5k views

Start analysis at any position in elf is Entry Point?

An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ?? please help ...
3
votes
1answer
1k views

Thread EntryPoint in TLS callback as AntiDebug technique

I came across a document called The Ultimate Anti-Reversing Reference, which describes various Anti-Debugging techniques. in point 4.Thread Local Storage There is a mention Thread Local Storage ...
3
votes
3answers
4k views

Exe protection by TLS callback, trying to understand the behaviour

I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS ...
3
votes
1answer
1k views

Why is this _DllMainCRTStartup calling convention not as expected?

I've been looking around at various DLLs on my computer lately and I thought a decent place to start was the image entry point (typically _DllMainCRTStartup). From what I can see of the CRT source ...
2
votes
1answer
3k views

How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger. So I loaded an executable process into it. And now I need to know the entry point (or base address) of that loaded executable, the same as I would get from ...
2
votes
1answer
145 views

Identifying ROM segment in unknown firmware update file

I am working on reversing a firmware update from a FujiFilm FinePix S1800 camera. So far I have managed to identify the instruction set (ARCompact) and dump a few things from the camera using the ...
2
votes
1answer
882 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
2
votes
1answer
3k views

Entry point for STM32 firmware

I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler). The values I try to figure ...
2
votes
1answer
258 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
2
votes
1answer
1k views

Why does Olly 2.01 fail to break at the module EP?

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it ...
2
votes
2answers
2k views

How to locate module_init() offset from ELF header of Linux kernel module?

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function....
1
vote
1answer
1k views

Problem with entry point detection as a file offset

I have found problem with finding file offset which actually is program entry point. In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address. ...
1
vote
1answer
138 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
1
vote
1answer
2k views

Reverse Engineer STM32L151's Firmware

I have the STM32L151's firmware that I extracted via JTAG, but I cannot find a start point in IDA. I have tried two methods: 1) I start IDA, drag the binary into the workspace, select ARM Little-...
1
vote
1answer
257 views

Finding out ARC file entry point

I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit ...
1
vote
0answers
152 views

Why program opened with OllyDbg 2 isn't paused at start? [duplicate]

There is one thing that I still can’t understand about Olly. I have a sample (an .SCR file) which I’m trying to analyze. When I open it with Olly 1.10, the file is loaded and its execution is paused ...
0
votes
1answer
2k views

DLL entry point in memory

I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match ...
0
votes
1answer
714 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
0
votes
1answer
26 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...