The AddressOfEntryPoint and Tips for Finding Main
Вставка
- Опубліковано 17 вер 2024
- The PE file format defines the entry point for execution through the AddressOfEntryPoint field. However, it's not as straight-forward as it may seem. In this video, we'll explore what this field is, where to find it and it's relationship with the main function.
Join this channel to get access to perks:
/ @jstrosch
Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 www.pluralsigh...
🌶️ UA-cam 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 / joshstroschein
🌎 Follow me 👉🏻 / jstrosch , / joshstroschein
⚙️ Tinker with me on Github 👉🏻 github.com/jst...
🤝 Join the Discord community and more 👉🏻 www.thecyberye...
0:38 Sample Binaries
1:14 Compiling
1:39 Finding AddressOfEntryPoint in 010 Editor
3:20 32-Bit PE file layout
3:46 Tips for Finding Main
5:15 Arguments for main in x64 binary
11:03 Start in a packed binary (Lockbit 3.0) - Наука та технологія
It's always nice to see other approaches to finding main to add to the toolbox, thanks!
Glad it was helpful :) It's served me well over the years, although I'm sure there are other ways to find main!
sir, can you please clarify my doubt :
The address at 04:15 like for ex, 0000000140001000 is Relative Virtual Address which is calculated by (base address + offset). If i am correct, now, when i debug this same binary or any binary using ida debugger. it shows a totally random address like 0x000000007f2342a9. so what is this ? is it also an virtual address or it's an physical address which is translated by mmu from virtual address. Please see this !
Hi! When I compiled that program, it was given a default image base of 140000000. You can view this info in the PE file format under IMAGE_OPTIONAL_HEADER. If the binary opts into ASLR, then the operating system will likely give it a different, random address. When debugging, you can view what the base address is for your EXE - in IDA i believe that is the modules window while debugging. It is still a virtual address, it's just randomized. ASLR is designed to help mitigate exploitations and helps not only EXEs, but DLLs be at unpredictable addresses. Hope this answers your question!
@@jstrosch yes i thought so it would have been ASLR as i did my fair share of binary exploitation. Thankyou sir !
@@Victimsingh Great - then you are no doubt familiar :)