I am reversing an ELF executable, and got the following:

0x080480ab      b880800408     movl $entry0, %eax          ; eip
0x080480b0      bb23810408     movl $section_end.LOAD0, %ebx ; section_end.LOAD0

It turned out that entry0 contains the beginning of the .text section and section_end.LOAD0 the end of it. However, this was not clear for immediately (entry0 is now clear, but I still do not know the origin of name section_end.LOAD0). Is there a documentation for these names? If not, can I ask radare2 to use memory addresses instead of these names?

  • 2
    Typically, those are explicitly exported symbols, and your disassembler helpfully replaces the addresses with the exported name. – usr2564301 Jan 25 '16 at 13:44
  • How can I improve the question dear downvoter? – robert Jan 27 '16 at 11:49

entry0 is the first entrypoint of your binary, section_end.LOAD0 is likely the end of the first (hence the 0) LOADable section :)

Your Answer

