1

I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this?

In other words of this output of objdump (objdump -d file)

enter image description here

how can I only extract: 8d 36 8d 3f 55 90 90 8d 36 89 e5 8d 36

2

If you want to extract all the opcode you can try to run this command:

objdump -d ./your_program|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'

If you need a shellcode format (\x8d\x36\x8d...), you can use this command:

objdump -d ./your_program|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'

Take a look at this page

2

you can use the multiple spaces pattern to rip the opcodes out

$ objdump -d c:/windows/system32/calc.exe | sed s/.*:[[:space:]]//g | sed s/[[:space:]][[:space:]].*//g | head -n 10

Disassembly of section .text:

01001000 <.text>:
68 04 82 73 08
57
88 73 29

~$ objdump -d c:/windows/system32/calc.exe | head -n 10

c:/windows/system32/calc.exe:     file format pei-i386


Disassembly of section .text:

01001000 <.text>:
 1001000:       68 04 82 73 08          push   $0x8738204
 1001005:       57                      push   %edi
 1001006:       88 73 29                mov    %dh,0x29(%ebx)
1

This works best for me (and looks easier to understand IMO)

objdump -r -j .text -d test | cut -d: -f2 | cut -d$'\t' -f 2

shellcode is best extracted via

hexdump -v -e '"\\""x" 1/1 "%02x" ""' test

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.