Can't find main symbol

[soomin-kim]

Hi,

I've tried to reassemble Coreutils binaries with Uroboros, but it doesn't work.
The first problem I've met was Uroboros is not able to find main function if it dosn't have specific assembly patterns.

The below is my Coreutils binary's _start function:

08048e30 <_start>:
 8048e30:       31 ed                   xor    %ebp,%ebp
 8048e32:       5e                      pop    %esi
 8048e33:       89 e1                   mov    %esp,%ecx
 8048e35:       83 e4 f0                and    $0xfffffff0,%esp
 8048e38:       50                      push   %eax
 8048e39:       54                      push   %esp
 8048e3a:       52                      push   %edx
 8048e3b:       e8 23 00 00 00          call   8048e63 <_start+0x33>
 8048e40:       81 c3 c0 a1 00 00       add    $0xa1c0,%ebx
 8048e46:       8d 83 30 b7 ff ff       lea    -0x48d0(%ebx),%eax
 8048e4c:       50                      push   %eax
 8048e4d:       8d 83 d0 b6 ff ff       lea    -0x4930(%ebx),%eax
 8048e53:       50                      push   %eax
 8048e54:       51                      push   %ecx
 8048e55:       56                      push   %esi
 8048e56:       c7 c0 35 b0 04 08       mov    $0x804b035,%eax
 8048e5c:       50                      push   %eax
 8048e5d:       e8 7e fe ff ff          call   8048ce0 <__libc_start_main@plt>
 8048e62:       f4                      hlt

If Uroboros track eax register, it can easily find the main is at 0x804b035.

Do you have a plan to use any simple data flow analysis to find main symbol so that it can find main function more generally?

Thank you.

[s3team]

thanks for the feedback. We’ll consider it in the future. Dinghao From: soomin-kim <[email protected]> Sent: Wednesday, April 3, 2019 8:22 AM To: s3team/uroboros <[email protected]> Cc: Subscribed <[email protected]> Subject: [s3team/uroboros] Can't find main symbol (#6) Hi, I've tried to reassemble Coreutils binaries with Uroboros, but it doesn't work. The first problem I've met was Uroboros is not able to find main function if it dosn't have specific assembly patterns. The below is my Coreutils binary's _start function: 08048e30 <_start>: 8048e30: 31 ed xor %ebp,%ebp 8048e32: 5e pop %esi 8048e33: 89 e1 mov %esp,%ecx 8048e35: 83 e4 f0 and $0xfffffff0,%esp 8048e38: 50 push %eax 8048e39: 54 push %esp 8048e3a: 52 push %edx 8048e3b: e8 23 00 00 00 call 8048e63 <_start+0x33> 8048e40: 81 c3 c0 a1 00 00 add $0xa1c0,%ebx 8048e46: 8d 83 30 b7 ff ff lea -0x48d0(%ebx),%eax 8048e4c: 50 push %eax 8048e4d: 8d 83 d0 b6 ff ff lea -0x4930(%ebx),%eax 8048e53: 50 push %eax 8048e54: 51 push %ecx 8048e55: 56 push %esi 8048e56: c7 c0 35 b0 04 08 mov $0x804b035,%eax 8048e5c: 50 push %eax 8048e5d: e8 7e fe ff ff call 8048ce0 <__libc_start_main@plt> 8048e62: f4 hlt If Uroboros track eax register, it can easily find the main is at 0x804b035. Do you have a plan to use any simple data flow analysis to find main symbol so that it can find main function more generally? Thank you. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fs3team%2Furoboros%2Fissues%2F6&data=02%7C01%7Cduw12%40psu.edu%7C4a3d400215a445e0d55d08d6b7fcbde6%7C7cf48d453ddb4389a9c1c115526eb52e%7C0%7C0%7C636898693503519461&sdata=WRrA1jUz40euGg9mVTZ2cjA5dUDWAuYv4hMNkKisi3g%3D&reserved=0>, or mute the thread<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAMy9mIUNklU4mMQosj74W1QhfoA0ka7Iks5vdEifgaJpZM4cZtR7&data=02%7C01%7Cduw12%40psu.edu%7C4a3d400215a445e0d55d08d6b7fcbde6%7C7cf48d453ddb4389a9c1c115526eb52e%7C0%7C0%7C636898693503529466&sdata=LSccf0y2TO2ivcMz8B5zSpnI1GYLhcY9pazLvdwiuYc%3D&reserved=0>.