Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

OK, so basically I want to re-use the content from dumped .rodata data and bss section from ELF on Linux 32bit.

The dump command:

objdump -s -j .text elf_binary
objdump -s -j .rodata elf_binary
objdump -s -j .data elf_binary

and for the .bss section, I am preparing to re-use a bunch of 00000000 which has the same size of the bss section.

It works fine when I re-use it in nasm assembler in this way.

.section rodata
S_label1: db 0x01
         db 0x02
         ....  
.section data
        db 0x01
S_label2:  db 0x02
         ....
.section bss
S_label3: db 0x00
         db 0x00
         ....

nasm -f elf test.s

But basically my question is that:

how to re-use these dumped sections in gas asssembler?

Basically gas has a different assemble style, and apparently the data sections representations are different...

I tried for several times and I still can not find the solution..

Did I clearly demonstrate my question..? Could anyone give me some help?

=======update==========

So basically I want to re-use the rodata data and bss sections dumped from another binary.

For example, here is the content of rodata section

03000000 01000200 0a0a556e 736f7274
65642061 72726179 2069733a 20200020
25642000 0a0a536f 72746564 20617272
61792069 733a2020 00

and I can re-use it in this way:

label1: 
db 0x03
db 0x00
db 0x00
db 0x00
label2: 
db 0x01
db 0x00
db 0x02
db 0x00
.....

mov eax, label1      // of course I will guarantee that I use it correctly
....

Basically in nasm, I can easily re-use them in the above way, but my question is that , how can I re-use it in gas (or directly use gcc) in a similiar way?

Is it possible?

share|improve this question
2  
Reuse for what exactly? Please describe the overall problem you're trying to solve here. –  Igor Skochinsky May 2 at 19:06
1  
I believe the poster is trying to reuse the content of these sections in an assembly program he/she's writing. –  yaspr May 2 at 19:15
    
@IgorSkochinsky Hi, I updated my question.. –  computereasy May 2 at 19:28
    
@yaspr Hi, I modifyed my question... Is it clear now? –  computereasy May 2 at 19:28

2 Answers 2

As an assembly programmer I would say that gas is rarely used to assemble external code. The task of calling gas is usually left to the compiler, and most of the assembly that gas has to handle in real life is either inlined inside C or C++ code or comes from a compiler. But, I believe this document by Dean Elsner, Jay Fenlanson & friends is by far the best reference I managed to rely on for quite sometime. It has been updated many times and it covers the 2.19.51 version.

The easy way would be to use GCC I would say :

  //Just to avoid make a point :]
  typedef unsigned char byte;

  //
  byte lbl1[] = { 0x03, 0x00, 0x00, 0x00, ... }, 
       lbl2[] = { 0x01, 0x00, 0x02, 0x00, ... };

  //I prefer Intel syntax rather than AT&T, it's somehow cleaner !
  __asm__("intel_syntax noprefix                 ;"
          "mov eax, %0                           ;"
          "mov ebx, %1                           ;"
          "att_syntax prefix                     ;"
          :                        //output
          : "r" (lbl1), "r" (lbl2) //input
          : "%eax", "%ebx");       //clobber

Well, this is a nice way if you want to concentrate on the assembly code (which is how I do it when I optimize code by hand).

Now, let me explain it a bit. First, you have two arrays containing the retrieved data, nothing fancy. Then you get the assembly code. If you're not familiar with inlined assembly I would recommend you this link, though I'll briefly go over my code. The __asm__ directive lets you insert assembly instructions anywhere in a code. At first I tell the assembler that I'll be using Intel's syntax (no % prefix for registers, ...), then I move the content of the register %0 in eax, and then the content of %1 in ebx (%0 is the pointer for lbl1, %1 is the pointer for lbl2). Then, I switch to AT&T syntax for the rest of the parameters. After the first : you can specify output variables. After the second : you can specify inputs. In here I passed lbl1 & lbl2 and I used "r" to let the compiler handle register allocation. You can specify the registers if you know what you're doing. After the last : you have to declare the registers used inside the code so that the compiler frees them & uses them for the remaining code generation steps.

share|improve this answer
    
Thank you @yaspr, I also wrote an answer below –  computereasy May 2 at 21:35

thanks @yaspr for his excellent answer.

So in this post I was asking that

How to re-use .rodata .data and .bss sections' contents?

Here is my answer:

you can quickly go this way once you dumped all the content of these sections, I use a hello world code to demostrate it:

.section .text
.globl  main
main:
push   %ebp
mov    %esp,%ebp
and    $0xfffffff0,%esp
sub    $0x20,%esp
fldl   S_80484f0     // lift the conceret address into symbol
fstpl  0x18(%esp)
fldl   0x18(%esp)
fstpl  0x4(%esp)
movl   $S_80484e0,(%esp) // lift the conceret address into symbol
call   printf
leave
ret
nop
nop
nop

.section .rodata

S_80484e0:
.long 0x6c6c6568
.long 0x6f77206f
.long 0x20642c72
.long 0x000a6625

S_80484f0:
.long 0x00000000
.long 0x40240000

To @yaspr about AT&T vs. Intel style:

It is obviously that Intel style is much more clear that AT&T:)

However, in the current project I am struggling on, I find it might not be very easy to use nasm inside a bunch of GNU tools(objdump objcopy ld and others...)

IMHO, Even though objdump can disassemble in Intel style, I still encounter a bunch of problems/unclear issues, especially after comparing the disassemble results between objdump and IDAPro

share|improve this answer
    
Well, you have to keep in mind that IDA & objdump do not perform disassembly the same way (not the same algorithms). objdump uses linear sweep which is a static disassembly technique that can give erroneous results. Especially if data is mixed up with instructions (shellcodes for example). You should trust none of tools you're using blindly, cross-reference their output if you want to efficient. Each one has its flaws & its strengths. I can assure you that using NASM with GNU tools wouldn't affect your work, though it your final choice. And, using multiple tools is a good way to learn. –  yaspr May 2 at 21:55
    
@yaspr Thank you for your reply! Yes, I know the difference in disassemble algorithm, so actually in the current project, I was trying to use IDAPro because it is believed the best, however, even though it is an excellent tool, I still find some un-match between the goal we want to achieve and IDAPro can support (disassemble binary for analysis). –  computereasy May 2 at 22:59
    
There's no such thing as the "best tool". There are only sharp & well documented users. IDAPro offers many features which can help you perform excellent analysis & recover lots of information about the target binary file. The most interesting thing about IDAPro is that it's scriptable. And that is not the case of most other tools. –  yaspr May 3 at 8:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.