-1

I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command. When I use

objdump -sj .text filename.exe

the output consists of the offset, in hexadecimal format, on the far left, followed by the content, in hexadecimal format, in the middle and a mixture of dots and ASCII characters on the right. I don't know if the dots represent unprintable characters.

Is there a way to adjust the format of the output? Ideally, I am hoping to get the printable strings without the hexadecimal numbers. I have looked through the objdump man page but could not see a way to do this.

  • Hi @otagoharbour, this question would likely be better asked on superuser.com – Jason Geffner Apr 28 '16 at 18:33
  • I tried posting it there but the only appropriate tag they had was linux and maybe hexdump. Thanks, – OtagoHarbour Apr 28 '16 at 18:42
1

Igor's answer is correct, but a bit short.

First, get the size and file offset of the .text segment using objdump -h:

$ objdump -h /path/to/Windows/System32/calc.exe
....
Idx Name          Size      VMA               LMA               File off  Algn
  0 .text         00060cc9  0000000100001000  0000000100001000  00000600  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .rdata        00010ec4  0000000100062000  0000000100062000  00061400  2**4
                  CONTENTS, ALLOC, LOAD, READONLY, DATA

Now you know the text section starts at 0x600 and ends at 0x61400.

Then, use strings and have it print the file offsets:

$ strings -a -t x -e l  /path/to/Windows/System32/calc.exe
  620e0 Edit
  62128 Button
  62138 SysDateTimePick32
  62160 ComboBox
  ...

In this particular file, as you see, there are no strings in the text segment; the first string (Edit) is already in the .rdata section. With most versions of strings, you don't need the -a, and you can select the character encoding with -e, 16 bit little endian in this case. See the manual page for other encodings.

You can use some of the Linux text utilities to further postprocess the output, but as @JasonGeffner said, superuser.com is a better place to ask about them.

1

If you want just printable strings from the binary, a better tool is the strings command.

  • I don't think strings can specifically select the .text section from a PE file. What would be ideal, as output, would be the individual bytes in extended ASCII format. Thanks, – OtagoHarbour Apr 28 '16 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.