What does objdump -b binary means?

Question

So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use

objdump -dS /path/to/malware

and I got the output

malwareFile: file format pei-i386
objdump: Reading section .text failed because: File truncated 

With a little search I found

Unable to dump malware assembly using objdump

So I use

objdump -b binary -D -m i386 /path/to/malware

and I got its mnemonic codes but I cannot understand what happen even after reading from the Linux man page. Does with this way, the data, bss and code segment be treated as a whole? Can I really depend on this solution for my research?

Answer 1

So, objdump's -d will only disassemble known code sections, usually .text and possibly other sections marked executable. If the section table is corrupted or missing, this will fail.

However, the section table is not actually required for a file to be executable by the OS, so it can be removed or modified without affecting the file's behavior. In such cases, you can use -b binary -D to tell objdump to disassemble all bytes in the file, ignoring any file structure. This will try to disassemble everything, including file headers, data sections, string tables etc. You will need to make sense out of the resulting disassembly by distinguishing actual code from nonsense produced by disassembling unrelated data. Alternatively, you can figure out the actual executable parts of the file and disassemble just that.

Answer 2

The -b switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The -D switch is also present in your question and this one means that objdump will treat the content of all sections as instructions even if it did take the header/file type into account.

If you onlt specify -D then it will treat all sections as instructions but it will print the section name before its data, so you can tell where it comes from.

That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is not less useful before it is unpacked. Unless of course the packing technique itself is of interest.