Skip to main content
added 151 characters in body
Source Link
Yotamz
  • 1.3k
  • 8
  • 20

The -b switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The -D switch is also present in your question and this one means that objdumpobjdump will treat the entire executablecontent of all sections as instructions even if it did take the header/file type into account.

If you onlt specify -D then it will treat all sections as instructions but it will print the section name before its data, likeso you saidcan tell where it comes from.

That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is not less useful before it is unpacked. Unless of course the packing technique itself is of interest.

The -b switch specifies the format as binary. The -D switch is also present in your question and this one means that objdump will treat the entire executable as instructions, like you said.

That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is not less useful before it is unpacked. Unless of course the packing technique itself is of interest.

The -b switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The -D switch is also present in your question and this one means that objdump will treat the content of all sections as instructions even if it did take the header/file type into account.

If you onlt specify -D then it will treat all sections as instructions but it will print the section name before its data, so you can tell where it comes from.

That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is not less useful before it is unpacked. Unless of course the packing technique itself is of interest.

Source Link
Yotamz
  • 1.3k
  • 8
  • 20

The -b switch specifies the format as binary. The -D switch is also present in your question and this one means that objdump will treat the entire executable as instructions, like you said.

That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is not less useful before it is unpacked. Unless of course the packing technique itself is of interest.