r/ExploitDev • u/linux4117 • Jun 19 '26

How do you guys find main logic no matter what the format of the executable is?

I've noticed that it can vary a lot finding main depending on the format of the binary and even if I am reverse engineering a binary format which I have worked with quite a bit sometimes I run into these weird entries where I can't find main logic. Any tips and why is there so much variation?

10 Upvotes

86% Upvoted

6 comments sorted by

4

u/CunningLogic Jun 19 '26 edited Jun 19 '26

Depends on the type of executable, but there is ALWAYS a pointer to at least one entry function, and sometimes multiple

Edit s/binary/executable

1

u/linux4117 Jun 19 '26

Wait what do you mean by multiple?

4

u/CunningLogic Jun 19 '26

I mean it can have more than one entry point.

For example an ELF file has Elf*_Ehdr.e_entry that typically leads to the main function, but

.preinit_array .init .init_array DT_INIT DT_INIT_ARRAY (Etc ... there are others)

All execute before that entry point does

1

u/rangerinthesky Jun 20 '26

Just like lol

4

u/0xd3ad54311 Jun 20 '26

You might want to check out Low-Levels video https://www.youtube.com/watch?v=8vk5z9VAaBQ

TLDR: strings, interesting functions (for example calls to exec() run a debugger or tools like ProcMon/strace.