[QUOTE=Lnju;1384789]main函数是由你IDA截图里的linc_init函数所调用,LDR R2, [R12, R3] 只是在给libc_init函数传递参数,然后由libc_init调用main[/QUOTE]
谢谢,懂了,函数地址作为参数传递
__noreturn void __libc_init(uintptr_t *elfdata,
void (*onexit)(void),
int (*slingshot)(int, char**, char**),
structors_array_t const * const structors)
{
int argc;
char **argv, **envp;
/* Initialize the C runtime environment */
__libc_init_common(elfdata);
/* Several Linux ABIs don't pass the onexit pointer, and the ones that
* do never use it. Therefore, we ignore it.
*/
/* pre-init array. */
call_array(structors->preinit_array);
/* .ctors section initializers, for non-arm-eabi ABIs */
call_array(structors->ctors_array);
// call static constructors
call_array(structors->init_array);
argc = (int) *elfdata;
argv = (char**)(elfdata + 1);
envp = argv + argc + 1;
/* The executable may have its own destructors listed in its .fini_array
* so we need to ensure that these are called when the program exits
* normally.
*/
if (structors->fini_array)
__cxa_atexit(__libc_fini,structors->fini_array,NULL);
exit(slingshot(argc, argv, envp));
}