Search code examples
c++debuggingassemblyreverse-engineering

Find Main in Assembly

I have simple C++ programm:

#include <iostream>  
using namespace std;  
void main()  
{  
    cout << "Hello, world, from Visual C++!" << endl;  
}

Compiled with following command: cl /EHsc hello.cpp

I want to start debugging of executable, How can I find this main function's corresponding assembly code in the debugger? (I'm using x64dbg)

Entry point is not same as Main function. I found main function and it is somewhere not near with Entry Point, I had strings and I found this easily.

Is there any way or rule or best practise how to guess where is main's corresponding assmebly code?

EDIT:

I have source code, but I just learning RE.

Solution

  • Although the entry point is usually not the main defined in your executable, this is merely because it is quite common for compilers to to wrap main with some initialization code.

    In most cases the initialization code is quite similar and has one of few versions per compiler. Most of those functions have an IDA FLIRT signature, and opening the binary with IDA will define an WinMain, main, etc function for you automatically. You can also use free (trial) versions of IDA for that.

    If that's not the case, it's pretty straight forward to get from the entrypoint to the main, by following the few calls inside the entrypoint function one level deep. the main call is usually near the end of the entrypoint function.

    Here's an example, main function is selected near the bottom (Note this is a unix executable compiled for windows using mingw, so this is somewhat different from most native win32 executables).

    mingw32 executable entry point