I know the the entry point is 4 bytes starting from offset 24 in the file, but I don't know how to translate this data into address.
There is no translation necessary when you run on the same target (x86
) as the one for which the executable has been built.
In pseudo-code, error checking omitted:
int fd = open(path, O_RDONLY);
lseek(fd, 24, SEEK_SET);
unsigned long entry_point;
read(fd, &entry_point, sizeof(entry_point));
printf("entry: 0x%lx\n", entry_point);
P.S. The 24 is only correct offset for Elf32
; it's much better to write this portably by reading entire Elf32_Ehdr
or Elf64_Ehdr
(depending on byte 5 being ELFCLASS32
or ELFCLASS64
) from offset 0, and then using .e_entry
member.