7 votes
Accepted

Thread EntryPoint in TLS callback as AntiDebug technique

When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS): Connect to the debuggee with DbgUiConnectToDbg Tell the kernel to ...
mrexodia's user avatar
  • 1,652
5 votes

Why is this _DllMainCRTStartup calling convention not as expected?

With global optimisation (link-time code generation) the compiler is free to ignore the declared calling convention for all functions that aren't externally visible - that is, neither exported nor ...
DarthGizka's user avatar
  • 2,010
5 votes

Start analysis at any position in elf is Entry Point?

The entry point isn't the address where you starts analyzing, but the address from where the process starts executing. Let's have a quick look at the ELF32 Header: #define EI_NIDENT 16 typedef ...
Megabeets's user avatar
  • 8,989
4 votes

Exe protection by TLS callback, trying to understand the behaviour

It is an old anti-debugging trick to use the TLS callback. The code in the TLS gets executed before the executables entry point and the debugger gains control. This allows the TLS to check for the ...
Crudd's user avatar
  • 41
4 votes
Accepted

How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?

You need to switch to a different command line. Currently, you're using the WinDbg command line, which allows you to send commands to WinDbg instead of IDAPython: Click on WinDbg, or press Ctrl↑ to ...
Martin's user avatar
  • 468
4 votes
Accepted

Entry point for STM32 firmware

The values are in little-endian I believe so the stack pointer is at 0x20000510 and the reset vector is 0x0800a905.
cimarron's user avatar
  • 1,341
3 votes

Find the entry point in Interrupt Vector Table ARM9

For the ARM946E-S Technical Reference Manual, the exception vectors (including the reset vector) should be located at either 0x00000000 or 0xFFFF0000 in memory, depending on whether the Alternate ...
Brendan Dolan-Gavitt's user avatar
3 votes

No apparent entry point for stripped, PIE binary using radare2

How can I find the entry point of this binary? There's a special radare2 command for this, ie: $ r2 /program_name -- Change the registers of the child process in this way: 'dr eax=0x333' [...
Megabeets's user avatar
  • 8,989
3 votes
Accepted

Identifying ROM segment in unknown firmware update file

The binary is not a single monolithic block. I figured out the structure but it took a few false starts. First I loaded the Binary into IDA starting from offset 0x200 as you hinted. The functions ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

Find the entry point in Interrupt Vector Table ARM9

The first bytes are the exception vectors: CODE:00000000 LDR PC, =0x1000005C CODE:00000004 ; --------------------------------------------------------------------------- ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

Start vs WinMain()

First, please read this. Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will ...
0xC0000022L's user avatar
  • 10.9k
2 votes
Accepted

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

You are sort of comparing oranges and apples. In the first example, you are looking at the arguments passed to the main function by the C library, and they match the C standard requirements (array ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

How to locate module_init() offset from ELF header of Linux kernel module?

To read with readelf the parameter is "-s": Options are: -a --all Equivalent to: -h -l -S -s -r -d -V -A -I -h --file-header Display the ELF file header -l --program-...
sinkmanu's user avatar
  • 121
2 votes
Accepted

Reverse Engineer STM32L151's Firmware

From the PDF to which you linked: 3.3.4 Boot modes At startup, boot pins are used to select one of three boot options: Boot from Flash memory Boot from System Memory Boot from ...
Jason Geffner's user avatar
2 votes

Exe protection by TLS callback, trying to understand the behaviour

Exceptions in TLSCallbacks are discarded by Windows, but stop further callbacks from being called, and then control is transferred to the main entrypoint. However, the code that you've shown for the ...
peter ferrie's user avatar
  • 4,709
2 votes

Start analysis at any position in elf is Entry Point?

No! Entry point is the "keyword" used to point at the location at which the OS loader will start a program. For a given binary file (ELFBIN), you can run the following command to read the binary's ...
yaspr's user avatar
  • 2,663
2 votes
Accepted

How to find "RawAddress" of a "VirtualAddress"?

you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote
Accepted

What is the state of the stack in the entry function?

In the _start function, argc, argv and envp are contained on the stack. A good read on this is the Linux x86 Program Start Up or - How the heck do we get to main()? When you run a program, the shell ...
Shane Reilly's user avatar
1 vote

How to find the file address of AddressOfEntryPoint

From your question it is not quite clear what you want to achieve: I assume you need the address in memory where you can find the "Address of Entry Point", as well as the file offset where ...
josh's user avatar
  • 1,974
1 vote

How to find the file address of AddressOfEntryPoint

In PE file, AddressOfEntryPoint is a relative address to the image base, so you will have 0x11046 - 0x10000 = 0x1046 value in Optional Header. For more information, see PE format and search for "...
bart1e's user avatar
  • 3,389
1 vote

Start analysis at any position in elf is Entry Point?

Entry point is where system loader will start execution of your executable. It's the entrypoint for the Operating system to begin execution in your program. The analogy could be "main()" function for ...
revittrk's user avatar
1 vote

Finding out ARC file entry point

Seems to be ARCompact code: CODE:00000000 mov r1, 0 CODE:00000004 mov r2, 0 CODE:00000008 mov r3, 0 CODE:0000000C mov ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Exe protection by TLS callback, trying to understand the behaviour

TLS callbacks may be executed on attach because the OS creates a new thread pointing to DbgUiBreakin with a software breakpoint to stop the execution of the program, and the new thread causes the TLS ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote
Accepted

Restoring an Infected appending virus EXE file by

It is important to do the entire process inside a virtual machine to avoid any additional file infections and/or suffer the malicious effects of the virus. Finding the original entry point This is ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible