GCC entrypoint address

Question

I am compiling a very basic "hello world" program with gcc, with this command line:

gcc -m32 prog_cible.c -o prog_cible

I am very surprised of the entry point address:

readelf -h prog_cible
...
Entry point: 0x420

I have tunrned off alsr with this command:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

I think this cannot be the real entry point. I suppose a base address is added to 0x420 ? In the past, 10 years ago, readelf gave me the good entry point. What has changed since ?

Thanks

Answer 1

I think this cannot be the real entry point.

You are correct. Your gcc is likely configured to build PIE binaries by default. PIE binary is really a special form of a shared library.

If you look at the type of the binary (which readelf -h also printed), you'll see that it's a DYN, not EXEC.

You can disable PIE with gcc -m32 -no-pie ..., and then your entry point will look something like 0x8048420.