The entry field lists the offset in the file that the program should start executing normally.
It points to your start method, but you can also update the entry and then point to wherever you want.
So let's see.
Uh, I have this c file where I have a main function which is printing hello world.
And I have a function which is not no one is calling this function, so I'm calling it as unused call.
Now, if I compile this one using gcc and run this, it will print me.
Hello world!
I can check the header file of this using readelf.
It has the entry point addresses 1060.
Okay, and I do an objdump f and d user space and a grep for start underscore start.
This is the function which is executing first before main.
So underscore start is having the address as 1060.
And main is having uh not underscore main.
Normal main is having address 1160.
So first uh 1060 is the starting entry point address.
Now this is also unused.
It is having 11491149 is the first option.
Uh, address of a new squall.
Now I will update, uh, the address of, uh, entry point.
It is to point to this, uh, this one.
So I will say print f.
So this is a command where I am writing, uh, 1149 in little endian format at the location of a entry,
uh, this entry point address in the radial header.
And I am adding two bytes.
So I said count equals to two.
So now I have written this one I can update, uh, I can check the DF header.
It is pointing to 1149.
And when I execute the user space it has executed uh uh.
This should not be executed.
And because I am not properly returning or exiting from this, I am not, uh, having a return value.
It is giving me a segmentation fault and it is giving a cotum.
So code impulses should be generated.
So it's a very simple example where we have, uh, updated entry.
And this, this way we can understand like entry point address is pointing to the correct location.
And if I when I have updated the entry point address to point to my function, which is not being called
by anyone, uh, not even the main and it did execute and we were able to, uh, get the logs.
And if we have added a proper written exit statement, then I should not have got the code dump.