If you were fortunate enough to have source code available for a C/C++ program that you wanted to analyze, a good place to begin your analysis might be the
main function, as this is where execution notionally begins. When faced with analyzing a binary, this is not a bad strategy to follow. However, as we know, it is complicated by the fact that compilers/linkers (and the use of libraries) add additional code that executes before
main is reached. Thus it would often be incorrect to assume that the entry point of a binary corresponds to the
main function written by the program’s author.
In fact, the notion that all programs have a
main function is a C/C++ compiler convention rather than a hard-and-fast rule for writing programs. If ...