Although it depends on the implementation, it's worth looking at a C program compiled with gcc. If you run objdump -d executable , you will see it parsed, and you will see how main() behaves. Here is an example:
08048680 <_start>: ... 8048689: 54 push %esp 804868a: 52 push %edx 804868b: 68 a0 8b 04 08 push $0x8048ba0 8048690: 68 30 8b 04 08 push $0x8048b30 8048695: 51 push %ecx 8048696: 56 push %esi 8048697: 68 f1 88 04 08 push $0x80488f1 804869c: e8 9f ff ff ff call 8048640 < __libc_start_main@plt > 80486a1: f4 hlt ... 080488f1 <main>: 80488f1: 55 push %ebp 80488f2: 89 e5 mov %esp,%ebp 80488f4: 57 push %edi 80488f5: 56 push %esi 80488f6: 53 push %ebx ... 8048b2b: 5b pop %ebx 8048b2c: 5e pop %esi 8048b2d: 5f pop %edi 8048b2e: 5d pop %ebp 8048b2f: c3 ret
You can see that the main one behaves similarly to a regular function, since it returns normally. In fact, if you look at the linux base documentation, you will see that the __libc_start_main call that we see from _start actually requires main to behave like a regular function.
source share