Problem: You have a dynamically linked binary with stripped symbols, How do you find where main() is loaded in memory? Answer: In gdb: We will use /bin/ls as an example. The way the ELF format works there is an absolute entry address. The very start of execution does a bunch of initialization and then lets the c run time takeover. The function that starts this all is libc_start_main The first argument of this function is a function pointer to main. libc_start_main( (int)(*func)(int argc, char *argv[], char **envp) func, ...); So here is how you find the entry point: (gdb) i file Symbols from "/bin/ls". Local exec file: `/bin/ls', file type elf32-i386. Entry point: 0x8049cd0 These are first instructions at the entry point: (gdb) x/20i 0x8049cd0 0x8049cd0: xor %ebp,%ebp 0x8049cd2: pop %esi 0x8049cd3: mov %esp,%ecx 0x8049cd5: and $0xfffffff0,%esp 0x8049cd8: push %eax 0x8049cd9: push %esp 0x8049cda: push %edx 0x8049cdb: push $0x805bd20 0x8049ce0: push $0x805bd30 0x8049ce5: push %ecx 0x8049ce6: push %esi 0x8049ce7: push $0x804fb50 0x8049cec: call 0x804980c <__libc_start_main@plt> 0x8049cf1: hlt 0x8049cf2: nop 0x8049cf3: nop 0x8049cf4: nop The c run time provides some functions for program initialization. This starts with libc_start_main and sets up the heap, runs constructors and destructors, and then calls the programs main function. The format of libc_start_main can be seen above. Here are the interesting parametsers, commented with ; comments 0x8049cd8: push %eax 0x8049cd9: push %esp 0x8049cda: push %edx 0x8049cdb: push $0x805bd20 ; constructor code 0x8049ce0: push $0x805bd30 ; destructor code 0x8049ce5: push %ecx 0x8049ce6: push %esi 0x8049ce7: push $0x804fb50 ; &main code 0x8049cec: call 0x804980c <__libc_start_main@plt> Final answer: Main begins at 0x804fb50.