-2

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this?
In other words of this output of objdump (objdump -d file)

enter image description here

how can I only extract:

lea 
lea
push
nop
nop
lea
mov
lea
3
  • 1
    Looks to me like you copied and pasted the content of another question. This is not how our community work. And next time, pay attention to the sentences you copy, you asked for the "middle" column but mentioned you want the mnemonics (lea, push,...) which in the right column
    – Megabeets
    Commented Apr 10, 2018 at 16:37
  • @Megabeets He is absolutely right ... I am working on a project and I need to find out how to do it. where I saw her would not let me ask.
    – Stone
    Commented Apr 10, 2018 at 16:41
  • 1
    @WilberConcepciónLugo I edited the question, but please use your own words next time. Ask a friend to check your English if you're not sure.
    – Igor Skochinsky
    Commented Apr 11, 2018 at 8:07

2 Answers 2

1

getting start address

objdump.exe -f calc.exe | grep start
start address 0x01012d6c

arguments passed to objdump via @File syntax where @File is disopt.txt containing arguments as below

C:\>cat disopt.txt
-d
-M intel
--no-show-raw-insn
--start-address         0x1012d6c
--stop-address          0x1012d8f

C:>objdump.exe @disopt.txt c:\Windows\System32\calc.exe | sed 1,7d | awk "{print $2}"

call
push
push
call
xor
mov
mov
lea
push
call

sed to remove first 7 lines
awk to print second column

actual disassembly without stripping lines and columns

C:\>objdump.exe @disopt.txt c:\Windows\System32\calc.exe

c:\Windows\System32\calc.exe:     file format pei-i386


Disassembly of section .text:

01012d6c <.text+0x11d6c>:
 1012d6c:       call   0x1012abc
 1012d71:       push   0x58
 1012d73:       push   0x1012ee8
 1012d78:       call   0x100c768
 1012d7d:       xor    ebx,ebx
 1012d7f:       mov    DWORD PTR [ebp-0x1c],ebx
 1012d82:       mov    DWORD PTR [ebp-0x4],ebx
 1012d85:       lea    eax,[ebp-0x68]
 1012d88:       push   eax
 1012d89:       call   DWORD PTR ds:0x100114c

Edit To answer the comment about two mnemonic (the prefix operands like lock rep , repz , repnz etc )

:\>objdump --no-show-raw-insn -d calc.exe | awk "{ if($2==\"lock\") {print $2,$3} }"
lock ja
lock (bad)
lock add
lock xadd
:\>objdump --no-show-raw-insn -d calc.exe | awk "{ if($2==\"rep\") {print $2,$3} }"
rep stos
rep movsl
4
  • ok, but how to know the address of the entry point to start disassembling? --start-address ??
    – Stone
    Commented Apr 10, 2018 at 19:45
  • and the opcodes that are two words (lock in) in this way only "lock" is extracted?
    – Stone
    Commented Apr 10, 2018 at 19:57
  • I want to execute the same file yours disopt.txt, but in the argument "--start-address" is the address of the entry point ... objdump @disopt.txt c:\Windows\System32\calc.exe | awk "{ if($2==\"lock\") {print $2,$3} else print $2 }" C:\>cat disopt.txt -d --no-show-raw-insn --start-address ????
    – Stone
    Commented Apr 12, 2018 at 14:15
  • objdump -f bin shows the entry point use that as i already answered
    – blabb
    Commented Apr 12, 2018 at 17:54
1

Columns in objdump output are commonly separated by tabs, so something like the following should help:

objdump -d program | sed  '/[^\t]*\t[^\t]*\t/!d' | cut -f 3 | sed 's/ .*$//' 

The first sed invocation removes lines not containing at least two tab characters (i.e. labels and other non-code output), cut returns the third tab-separated column of the remaining output and the final sed gets rid of the first space character and the rest of each line, i.e. all text after the opcode.

(This question might have been better suited for the unix stackexchange community)

5
  • that command line and it still does not work for me, can you help me? Thanks.
    – Stone
    Commented Apr 10, 2018 at 16:33
  • 1
    Did you get any errors? What OS are you using?
    – user22967
    Commented Apr 10, 2018 at 18:04
  • There is something wrong in that sequence with the "sed". Windows 10.Did it work for you?
    – Stone
    Commented Apr 10, 2018 at 19:06
  • Yes, however I ran this on Linux (Debian 9 on x64) with GNU objdump (GNU Binutils for Debian) 2.28, sed (GNU sed) 4.4 and cut (GNU coreutils) 8.26. However, I don't think any of these options are exotic. Can you upload the output you get from objdump somewhere?
    – user22967
    Commented Apr 10, 2018 at 21:26
  • @MichaelEngel just replace the single quote with double quote should work as is in windows
    – blabb
    Commented Apr 10, 2018 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.