Writing a simple hello_world.c program, and compile with 32-bit MinGW, the
objdump can show symbol table using:
objdump -t hello_world.exe
And the symbol table then have an entry for
... [ 32](sec 1)(fl 0x00)(ty 20)(scl 2) (nx 1) 0x00000460 _main ...
However, when loading the
hello_world.exe file in
x64dbg debugger, the
_main symbol is not shown, as can be seen from the symbol list below
hello_world module is selected.
This is annoying, since I would like to create a breakpoint at start of user
hello_world, and using the symbols to jump to the start location
would be very convenient.
Any idea on how to get the
_main symbols included in the symbol list?
While PE has support for storing debug information, the symbol table is mostly an ELF concept.
If you look at the PE sections (use objdump -h) you'll see a lot of extra sections not referenced in the PE directories.
These are used by the binutils to extract the DWARF information and show you, for example, the symbol table.
x64dbg is a pure Windows/PE tool and doesn't understand DWARF.
However, it will show you the address of the PE entry-point (rarely the address of the "
main" itself though) and will put a breakpoint there for you automatically.
The Entry-point is shown under the export symbols of the binary under inspection.
Furthermore, x64dbg will break on 'ntdll` allowing you to reach the entry-point with a ninja use of CTRL+F9 (beware of TLS initialization callbacks).
To get to
main you can step through the code until you find a call to an address in the
.text section or simply a call followed by two calls to
Also, given the offset of
_main retrieved with
objdumpt -t the VA of
_main is is
BASE ADDRESS +
.text RVA +
In my case, this was
User contributions licensed under CC BY-SA 3.0