1

Follower this question (thanks "Igor Skochinsky")

when use objdump -b binary ... we can't see correct disassemble in section-less elf file

Because objdump disassemble Header and code and we see false disassemble code.

What better way to do it right there?

  • 2
    Have you considered using a full-blown disassembler product? Most will support sectionless elf files out of the box. – NirIzr Oct 31 '16 at 23:46
3

I write mini ruby script for dump DATA from EP to end of file and save it to another file

then we can disassemble it with objdump -b binary .. very nice

$ 
$ objdump -b binary -m i386 -D RAW

this script read ELF file and find endian mode (little or Big) then find EP and dump it

in this picture we can see difference between this command's

enter image description here

we can set and change EP from -E , and length data of dump from -l "end-1" or set start of dump without calculate EP with -s command

[downlaod and fork me][2]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.