我在 64 位 Windows 7 上运行，并使用radare2 尝试对二进制可执行文件进行静态和动态分析。问题是我似乎找不到程序正确开始的入口点。总的来说，我对radare2和逆向工程还是很陌生，所以我目前知道的所有技术都无法确定这一点。
我的问题是：
- 我怎样才能找到这个二进制文件的入口点？（并且，一般来说，任何二进制文件）
- 为什么没有明显的
main符号？ - 为什么检查
afll失败？（见下文）
我已经记录了我的尝试（按时间顺序），如下：
我使用radare2在调试模式（通过-d）打开二进制文件，如下所示：
$ radare2 -d bin.exe
Spawned new process with pid 6204, tid = 6408
r_sys_pid_to_path: Cannot get module filename.= attach 6204 6408
bin.baddr 0x00400000
Using 0x400000
Spawned new process with pid 5764, tid = 1936
r_sys_pid_to_path: Cannot get module filename.asm.bits 32
Radare2 在地址输入，0x772201c4然后我运行aaa：
[0x772201c4]> aaa
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
TODO: esil-vm not initialized
←[32m[x]←[0m Analyze len bytes of instructions for references (aar)
←[32m[x]←[0m Analyze function calls (aac)
←[32m[x]←[0m Use -AA or aaaa to perform additional experimental analysis.
←[32m[x]←[0m Constructing a function name for fcn.* and sym.func.* functions (aan)
= attach 6204 6408
6204
所有检查似乎都失败了，因此我尝试通过 显示入口点的地址iM，但无济于事：
[0x772201c4]> iM
[0x772201c4]>
目前也没有上市的sym.main有afll两种：
[0x772201c4]> afll
address size nbbs edges cc cost min bound range max bound calls locals args xref frame name
=========== ==== ===== ===== ===== ==== =========== ===== =========== ===== ====== ==== ==== ===== ====
0x772201c4 41 1 0 1 4 0x772201c4 13 0x772201d1 2 2 0 0 24 fcn.eip
0x7723df5c 69 1 0 1 29 0x7723df5c 69 0x7723dfa1 0 5 0 1 28 fcn.7723df5c
0x7723dfa1 20 1 0 1 14 0x7723dfa1 20 0x7723dfb5 0 1 0 1 0 fcn.7723dfa1
0x7724989f 69 4 5 3 23 0x7724989f 18 0x772a034a 0 0 1 1 4 fcn.7724989f
0x772498ba 28 1 0 1 22 0x772498ba 28 0x772498d6 2 1 2 1 24 loc.772498ba
0x772498db 54 2 1 0 24 0x772498db 54 0x77249911 4 1 2 1 16 fcn.772498db
0x77266fa6 66 4 5 3 48 0x77266fa6 66 0x77266fe8 5 1 1 1 48 fcn.77266fa6
很困惑，我试了一下pdf，只得到了三行汇编助记符：
[0x772201c4]> pdf
;-- eip:
/ (fcn) fcn.eip 41
| fcn.eip ();
| ; var int local_4h @ esp+0x4
| ; var int local_8h @ esp+0x8
| 0x772201c4 89442404 mov dword [local_4h], eax
| 0x772201c8 895c2408 mov dword [local_8h], ebx
\ ,=< 0x772201cc e9e9960200 jmp loc.772498ba
编辑 1：按照Megabeet的建议，这是我的输出：
$ radare2 bin.exe
[0x00404161]> ie
[Entrypoints]
vaddr=0x00404161 paddr=0x00004161 baddr=0x00400000 laddr=0x00000000 haddr=0x00000118 type=program
1 entrypoints
[0x00404161]> ood
Spawned new process with pid 4776, tid = 4528
r_sys_pid_to_path: Cannot get module filename.File dbg://bin.exe reopened in read-write mode
= attach 4776 4528
Spawned new process with pid 5720, tid = 4780
r_sys_pid_to_path: Cannot get module filename.Unable to find filedescriptor 3
Unable to find filedescriptor 3
4776
[0x772201c4]>