Enter a
payload at main, skipping its runtime start
A one-bit experiment nobody has run, and it may retire the only research problem on PAYLOADS.md.
All five open-toolchain payloads die in __crt_start at a
ud2, rejecting the handoff structure orbistoun cannot
supply (D308). But main is a real, sized,
GLOBAL FUNC symbol in three of them - klogsrv (685 bytes),
shsrv (217), ftpsrv (615) - so it can be located by name without
deriving anything.
If __crt_start is what unpacks the structure and calls
main(argc, argv) - the ordinary shape - then entering at
main sidesteps the whole problem for those three. klogsrv's
DT_INIT_ARRAY is empty, so there is nothing being skipped
that runs constructors.
Costs an entry-address override, which EntrySettings has
no field for yet. Decisive either way: if the guest
starts calling imports, three payloads are unblocked and the sweep is
only needed for the two stripped ones. If it dies the same way,
main itself takes the structure, which is worth knowing
before spending boots on a sweep.