Question

I am currently compiling a bought data stack in C. I use their own tool to compile it, using in the background gcc. I can pass flags and parameters to gcc as I see fit. I want to know, from which file is the main() used. That is, in the project, which file is the starting point. Is there any way to tell gcc to generate a list of files, or similar, given that I dont know from which file is main() being taken? Thank you.

Answer 1

You can disassemble the final executable to find the starting point. Although you have not provided any additional info to help you more. I’m using a sample code to demonstrate the process.

#include <stdio.h>

   int main() {
           printf("hello world\n");
           return 0;
   }

Now the object main.o has the following this

[root@s1 sf]# gcc -c main.c
[root@s1 sf]# nm main.o
0000000000000000 T main
                 U puts

You can see main is not initialized. Because it will changed in linking stage. Now after linking :

$gcc main.o
$nm a.out
                 U __libc_start_main@@GLIBC_2.2.5
0000000000600874 A _edata
0000000000600888 A _end
00000000004005b8 T _fini
0000000000400390 T _init
00000000004003e0 T _start
000000000040040c t call_gmon_start
0000000000600878 b completed.6347
0000000000600870 W data_start
0000000000600880 b dtor_idx.6349
00000000004004a0 t frame_dummy
00000000004004c4 T main

You see that main has a address now. But its still not final. Because this main will called by C runtime dynamically. you can see who will do the part of U __libc_start_main@@GLIBC_2.2.5:

[root@s1 sf]# ldd a.out 
    linux-vdso.so.1 =>  (0x00007fff61de1000)  /* the linux system call interface */
    libc.so.6 => /lib64/libc.so.6 (0x0000003c96000000) /* libc runime , this will invoke your main*/
    /lib64/ld-linux-x86-64.so.2 (0x0000003c95c00000) /* dynamic loader */

Now you can verify this by viewing the disassembly :

00000000004003e0 <_start>:
..........
4003fd: 48 c7 c7 c4 04 40 00    mov    rdi,0x4004c4 /* address of start of main */
400404: e8 bf ff ff ff          call   4003c8 <__libc_start_main@plt> /* this will set up the environment for main, like pushing argc and argv to stack */
...........

If you don’t have the source with you, then you can search in the executable for references to libc_start_main or main or start to see how your executable is initialized and starts the main.

Now all of these is done when linking is done with default linker script. Many big project will use its own linker script. If your project has custom linker script, then finding the start point will be different depending on the linker script used. There are projects which does not uses glibc's runtime. In that case, its still possible to find the start point by hacking the object files, library archives etc.

If your binary is stripped from symbols, then you have to actually rely on your assembler skill to find where it starts.

I’ve assumed that you don’t have the source, that is the stack is distributed with some libraries and some header definitions only.(A common practice of commercial software vendors).

But if you have source with you, then its just too trivial. just grep your way through it. Some answers already pointed that out.