{"action":"created","issue":{"url":"https://api.github.com/repos/eteran/edb-debugger/issues/473","repository_url":"https://api.github.com/repos/eteran/edb-debugger","labels_url":"https://api.github.com/repos/eteran/edb-debugger/issues/473/labels{/name}","comments_url":"https://api.github.com/repos/eteran/edb-debugger/issues/473/comments","events_url":"https://api.github.com/repos/eteran/edb-debugger/issues/473/events","html_url":"https://github.com/eteran/edb-debugger/issues/473","id":190619707,"number":473,"title":"main() heuristic seems incorrect/incomplete","user":{"login":"AaronOpfer","id":1189089,"avatar_url":"https://avatars.githubusercontent.com/u/1189089?v=3","gravatar_id":"","url":"https://api.github.com/users/AaronOpfer","html_url":"https://github.com/AaronOpfer","followers_url":"https://api.github.com/users/AaronOpfer/followers","following_url":"https://api.github.com/users/AaronOpfer/following{/other_user}","gists_url":"https://api.github.com/users/AaronOpfer/gists{/gist_id}","starred_url":"https://api.github.com/users/AaronOpfer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AaronOpfer/subscriptions","organizations_url":"https://api.github.com/users/AaronOpfer/orgs","repos_url":"https://api.github.com/users/AaronOpfer/repos","events_url":"https://api.github.com/users/AaronOpfer/events{/privacy}","received_events_url":"https://api.github.com/users/AaronOpfer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-11-21T05:02:02Z","updated_at":"2016-11-21T07:32:12Z","closed_at":null,"body":"The ELF64 `main`-finding heuristic scans bytes past the entrypoint and looks for this signature:\r\n\r\n```\r\n// beginning of a call preceeded by a 64-bit mov and followed by a hlt\r\nif(ba[0] == 0x48 && ba[1] == 0xc7 && ba[7] == 0xe8 && ba[12] == 0xf4)\r\n```\r\n\r\nHowever, I compiled this test program with `gcc test2.c -o test2`:\r\n```C++\r\n#include <stdio.h>\r\n\r\nint main(int argc, char* argv[]) {\r\n    printf(\"Hello, %s\", \"World\");\r\n}\r\n```\r\n\r\nand my entrypoint looks like this (main() is at 0x5555555546b0):\r\n\r\n![image](https://cloud.githubusercontent.com/assets/1189089/20471065/ffbdfaa0-af73-11e6-96e0-55dea06b809f.png)\r\n\r\n * the `lea rdi, [rel 0x5555555546b0]` instruction before the call is `48 8d` but the heuristic is looking for `48 c7` (which doesn't even appear to be a valid opcode)\r\n * the `call qword [rel 0x555555754fd8]` is `ff 15` but the heuristic is looking for `e8` (which is \"call <32bit immed>\")\r\n\r\nThe heuristic like it may have worked at some point. Maybe this is a libc change?\r\n\r\nGCC info\r\n```\r\n$ gcc -v\r\nUsing built-in specs.\r\nCOLLECT_GCC=gcc\r\nCOLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/6/lto-wrapper\r\nTarget: x86_64-linux-gnu\r\nConfigured with: ../src/configure -v --with-pkgversion='Debian 6.2.0-13' --with-bugurl=file:///usr/share/doc/gcc-6/README.Bugs --enable-languages=c,ada,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-6 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --enable-default-pie --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-6-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-6-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-6-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu\r\nThread model: posix\r\ngcc version 6.2.0 20161109 (Debian 6.2.0-13)'\r\n```"},"comment":{"url":"https://api.github.com/repos/eteran/edb-debugger/issues/comments/261863674","html_url":"https://github.com/eteran/edb-debugger/issues/473#issuecomment-261863674","issue_url":"https://api.github.com/repos/eteran/edb-debugger/issues/473","id":261863674,"user":{"login":"10110111","id":6376882,"avatar_url":"https://avatars.githubusercontent.com/u/6376882?v=3","gravatar_id":"","url":"https://api.github.com/users/10110111","html_url":"https://github.com/10110111","followers_url":"https://api.github.com/users/10110111/followers","following_url":"https://api.github.com/users/10110111/following{/other_user}","gists_url":"https://api.github.com/users/10110111/gists{/gist_id}","starred_url":"https://api.github.com/users/10110111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/10110111/subscriptions","organizations_url":"https://api.github.com/users/10110111/orgs","repos_url":"https://api.github.com/users/10110111/repos","events_url":"https://api.github.com/users/10110111/events{/privacy}","received_events_url":"https://api.github.com/users/10110111/received_events","type":"User","site_admin":false},"created_at":"2016-11-21T07:32:12Z","updated_at":"2016-11-21T07:32:12Z","body":"Could you check with older gcc if possible? My screenshot results from GCC 5.3.0."}}
{"actor":{"display_login":"10110111"}}