-2

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this?
In other words of this output of objdump (objdump -d file)

enter image description here

how can I only extract:

lea 
lea
push
nop
nop
lea
mov
lea
  • 1
    Looks to me like you copied and pasted the content of another question. This is not how our community work. And next time, pay attention to the sentences you copy, you asked for the "middle" column but mentioned you want the mnemonics (lea, push,...) which in the right column – Megabeets Apr 10 '18 at 16:37
  • @Megabeets He is absolutely right ... I am working on a project and I need to find out how to do it. where I saw her would not let me ask. – Stone Apr 10 '18 at 16:41
  • 1
    @WilberConcepciónLugo I edited the question, but please use your own words next time. Ask a friend to check your English if you're not sure. – Igor Skochinsky Apr 11 '18 at 8:07
1

getting start address

objdump.exe -f calc.exe | grep start
start address 0x01012d6c

arguments passed to objdump via @File syntax where @File is disopt.txt containing arguments as below

C:\>cat disopt.txt
-d
-M intel
--no-show-raw-insn
--start-address         0x1012d6c
--stop-address          0x1012d8f

C:>objdump.exe @disopt.txt c:\Windows\System32\calc.exe | sed 1,7d | awk "{print $2}"

call
push
push
call
xor
mov
mov
lea
push
call

sed to remove first 7 lines
awk to print second column

actual disassembly without stripping lines and columns

C:\>objdump.exe @disopt.txt c:\Windows\System32\calc.exe

c:\Windows\System32\calc.exe:     file format pei-i386


Disassembly of section .text:

01012d6c <.text+0x11d6c>:
 1012d6c:       call   0x1012abc
 1012d71:       push   0x58
 1012d73:       push   0x1012ee8
 1012d78:       call   0x100c768
 1012d7d:       xor    ebx,ebx
 1012d7f:       mov    DWORD PTR [ebp-0x1c],ebx
 1012d82:       mov    DWORD PTR [ebp-0x4],ebx
 1012d85:       lea    eax,[ebp-0x68]
 1012d88:       push   eax
 1012d89:       call   DWORD PTR ds:0x100114c

Edit To answer the comment about two mnemonic (the prefix operands like lock rep , repz , repnz etc )

:\>objdump --no-show-raw-insn -d calc.exe | awk "{ if($2==\"lock\") {print $2,$3} }"
lock ja
lock (bad)
lock add
lock xadd
:\>objdump --no-show-raw-insn -d calc.exe | awk "{ if($2==\"rep\") {print $2,$3} }"
rep stos
rep movsl
  • ok, but how to know the address of the entry point to start disassembling? --start-address ?? – Stone Apr 10 '18 at 19:45
  • and the opcodes that are two words (lock in) in this way only "lock" is extracted? – Stone Apr 10 '18 at 19:57
  • I want to execute the same file yours disopt.txt, but in the argument "--start-address" is the address of the entry point ... objdump @disopt.txt c:\Windows\System32\calc.exe | awk "{ if($2==\"lock\") {print $2,$3} else print $2 }" C:\>cat disopt.txt -d --no-show-raw-insn --start-address ???? – Stone Apr 12 '18 at 14:15
  • objdump -f bin shows the entry point use that as i already answered – blabb Apr 12 '18 at 17:54
1

Columns in objdump output are commonly separated by tabs, so something like the following should help:

objdump -d program | sed  '/[^\t]*\t[^\t]*\t/!d' | cut -f 3 | sed 's/ .*$//' 

The first sed invocation removes lines not containing at least two tab characters (i.e. labels and other non-code output), cut returns the third tab-separated column of the remaining output and the final sed gets rid of the first space character and the rest of each line, i.e. all text after the opcode.

(This question might have been better suited for the unix stackexchange community)

  • that command line and it still does not work for me, can you help me? Thanks. – Stone Apr 10 '18 at 16:33
  • 1
    Did you get any errors? What OS are you using? – user22967 Apr 10 '18 at 18:04
  • There is something wrong in that sequence with the "sed". Windows 10.Did it work for you? – Stone Apr 10 '18 at 19:06
  • Yes, however I ran this on Linux (Debian 9 on x64) with GNU objdump (GNU Binutils for Debian) 2.28, sed (GNU sed) 4.4 and cut (GNU coreutils) 8.26. However, I don't think any of these options are exotic. Can you upload the output you get from objdump somewhere? – user22967 Apr 10 '18 at 21:26
  • @MichaelEngel just replace the single quote with double quote should work as is in windows – blabb Apr 10 '18 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.