Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to get to entry point with windbg

Hi I have some trouble understanding how does one work with windbg. So far I have only used IDA pro free and ollydbg for reading assembly produced by cl.exe, the visual studio compiler, which is what I want to do only using windbg instead. I dont add any debugging information to my programs, I just want to see the assembly. Basicaly the problem Im having is that I cant get to the entry point of my executable. After loading the executable, windbg prints some warnings about no symbol files found, which I dont care about and since breakpoints dont get me anywhere I decided to get there simply by repeating "step over" a couple times (which is "p" right?). The debug starts at some high addresses in ntdll and after couple steps it stops debugging after calling NtContinue with "no debugee error". Thank you, stu.

like image 995
Pyjong Avatar asked Dec 15 '22 17:12

Pyjong


1 Answers

$exentry The address of the entry point of the first executable of the current process. Note: if you use the CRT then this will be the CRT's main that eventually calls your main.

So try u $exentry to start disassembling. You'll eventually find the call instruction that calls your main.

like image 89
Marc Sherman Avatar answered Jan 25 '23 23:01

Marc Sherman