ARM-8 定位发布版本 pstree 程序的 main 地址
逆向时如何找到main，如下：
1.readelf -h pstree
ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: AArch64
Version: 0x1
Entry point address: 0x402ec0
Start of program headers: 64 (bytes into file)
Start of section headers: 182632 (bytes into file)
Flags: 0x0
Size of this header: 64 (bytes)
Size of program headers: 56 (bytes)
Number of program headers: 9
Size of section headers: 64 (bytes)
Number of section headers: 28
Section header string table index: 27
2.0x402ec0 代码
402ec0: d503201f nop
402ec4: d280001d mov x29, #0x0 // #0
402ec8: d280001e mov x30, #0x0 // #0
402ecc: aa0003e5 mov x5, x0
402ed0: f94003e1 ldr x1, [sp]
402ed4: 910023e2 add x2, sp, #0x8
402ed8: 910003e6 mov x6, sp
402edc: 90000000 adrp x0, 402000 <ferror@plt+0x120>
402ee0: 913bd000 add x0, x0, #0xef4
402ee4: d2800003 mov x3, #0x0 // #0
402ee8: d2800004 mov x4, #0x0 // #0
402eec: 97fffad5 bl 401a40 <__libc_start_main@plt>
402ef0: 97fffb78 bl 401cd0 <abort@plt>
402ef4: d503201f nop
402ef8: 17fffc02 b 401f00 <ferror@plt+0x20>
402efc: d503201f nop
402f00: d65f03c0 ret
3.main 地址
402ef8: 17fffc02 b 401f00 <ferror@plt+0x20>
4.401f00 代码
0000000000401f00 <.text>:
401f00: a9b97bfd stp x29, x30, [sp, #-112]!
401f04: d288fe0d mov x13, #0x47f0 // #18416
401f08: 900000c2 adrp x2, 419000 <ferror@plt+0x17120>
401f0c: 910003fd mov x29, sp
401f10: a90153f3 stp x19, x20, [sp, #16]
401f14: 912a0042 add x2, x2, #0xa80
401f18: d00001c3 adrp x3, 43b000 <ferror@plt+0x39120>
401f1c: a9025bf5 stp x21, x22, [sp, #32]
401f20: 91378063 add x3, x3, #0xde0
401f24: aa0103f4 mov x20, x1
401f28: a90363f7 stp x23, x24, [sp, #48]
401f2c: 91014041 add x1, x2, #0x50
5.动态调试确认
原文地址：https://blog.csdn.net/xiaozhiwise/article/details/143585567
免责声明：本站文章内容转载自网络资源，如本站内容侵犯了原著者的合法权益，可联系本站删除。更多内容请关注自学内容网（zxcms.com）！