11.2 Entrypoint

The flag "-e" lets us know the program entrypoint.

$ rabin -e /bin/ls
0x08049a40

Again, if we mix it with -v we get a better human readable output.

$ rabin -ev /bin/ls
[Entrypoint]
Memory address: 0x08049a40

With -vv we will get more information, in this case the memory location as well as the file offset.

$ rabin -evv /bin/ls
[Entrypoint]
Memory address: 0x08049a40
File offset:    0x00001a40

Combined with -r radare will create a new flag space called "symbols", and it will add a flag named "entrypoint" which points to the program's entrypoint. Thereupon, radare will seek it.

$ rabin -er /bin/ls
fs symbols
f entrypoint @ 0x08049a40
s entrypoint