I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this:init()while (1) {   main();  }or the main() itself contains a super loop. However, the strange things are 1) I am not able to find any calling references for the main(). 2) Nor can I identify a super loop structure inside main().The main() is like this:  B1: PUSH    {R3-R7,LR}  ...RN_end_of_main:  B2: POP     {R3-R7}  B3: POP     {R3}  B4: BX      R3  (end of main)The init() is like this (directly following main()):  A1: PUSH    {R3-R7,LR}      ...  A2: LDR     R0, main+1    # This is the only place that references main()  A3: B       RN_end_of_main  (end of init)  (data)A1, A2, .. B3 are line numbers added by myself here for easier explanation.First off, IDA Pro shows Three are no refs to main() when using Jumps to xrefs to operand... function. And line A2 is the only place in the whole firmware disassembly that references main(). However , it put address main+1 to R0 which I don't understand. It looks like R0 is not used after jumping to RN_end_of_main, and the init() will just return using the originally pushed LR which will go nowhere.Anything missing in my understanding of this code? And is there some hidden way that main() can be called?
Cannot find the caller of the main function in a disassembled firmware
ida;disassembly;binary analysis;arm