Skip to main content
added 32 characters in body
Source Link
julian
  • 7.2k
  • 3
  • 23
  • 56

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, assembles it, compiles thetranslates source code to assembly, translates that to machine code, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, you can use the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, assembles it, compiles the assembly, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, you can use the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, translates source code to assembly, translates that to machine code, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, you can use the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi
deleted 7 characters in body
Source Link
julian
  • 7.2k
  • 3
  • 23
  • 56

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, assembles it, compiles the assembly, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, my advice is usingyou can use the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, assembles it, compiles the assembly, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, my advice is using the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, assembles it, compiles the assembly, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, you can use the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi
Source Link
julian
  • 7.2k
  • 3
  • 23
  • 56

Linux binutils tools, such as objdump, gdb etc. rely on the BFD library, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own libopcodes-based disassembler that does this, the following article will help you get started: Basic disassembly with libopcodes.

GCC is a compiler toolchain, which performs preprocessing of the source file, assembles it, compiles the assembly, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.

If you want to disassemble individual bytes, my advice is using the Capstone disassembly framework's Python bindings to write scripts that disassemble the byte values that you specify. Here is an example:

#!/usr/bin/python3

from capstone import *

CODE = b"\x55"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

The output is 0x1000: push ebp

When we consult the x86 opcode table, we see that a value of 0x50 + the register = Push Word, Doubleword or Quadword Onto the Stack. So if we change 0x55 to 0x54 the output becomes 0x1000: push esp - a different register is pushed. 0x50 = push eax. And so forth.

Here is a modified version of the above script:

#!/usr/bin/python3

from capstone import *

CODE = b"\x50\x51\x52\x53\x54\x55\x56\x57"

md = md = Cs(CS_ARCH_X86, CS_MODE_32)
for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

This prints

0x1000: push    eax
0x1001: push    ecx
0x1002: push    edx
0x1003: push    ebx
0x1004: push    esp
0x1005: push    ebp
0x1006: push    esi
0x1007: push    edi