Question

I created a test app and then exported as IPA file. I used IDA pro to look into the executable binary file. I found that the main function is called by start subsroutine:

BLX  _main

So I concluded that the entry point of a mach-o executable is start subroutine, which eventually call the main function.

However, when I tried opening executable file of other apps (which I grabbed using Clutch), I found that there was no _main function at all, but instead some thing like sub_2A4C.

I would like to know why there is such a difference?

Was it helpful?

Solution

You conclusion is not right. It is true that the entry point is the start subroutine, it is also true that the start subroutine eventually calls the main function declared in your code. However, if you choose Yes in the option 'Deployment Postprocessing' and 'Strip Linked Product 'in the Xcode build setting, your symbol will be stripeed, so you won't see main function as _main anymore, but obfuscated such as sub_2A4C.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top