1

So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use

objdump -dS /path/to/malware

and I got the output

malwareFile: file format pei-i386
objdump: Reading section .text failed because: File truncated 

With a little search I found

Unable to dump malware assembly using objdump

So I use

objdump -b binary -D -m i386 /path/to/malware

and I got its mnemonic codes but I cannot understand what happen even after reading from the Linux man page. Does with this way, the data, bss and code segment be treated as a whole? Can I really depend on this solution for my research?

  • What exactly do you mean by "truncated"? can you add the actual message you've got? – Igor Skochinsky Apr 19 at 15:57
  • @IgorSkochinsky malwareFile: file format pei-i386 objdump: Reading section .text failed because: File truncated – 0sunday Apr 19 at 16:21
  • thanks, please add it to the question body – Igor Skochinsky Apr 19 at 16:24
1

So, objdump's -d will only disassemble known code sections, usually .text and possibly other sections marked executable. If the section table is corrupted or missing, this will fail.

However, the section table is not actually required for a file to be executable by the OS, so it can be removed or modified without affecting the file's behavior. In such cases, you can use -b binary -D to tell objdump to disassemble all bytes in the file, ignoring any file structure. This will try to disassemble everything, including file headers, data sections, string tables etc. You will need to make sense out of the resulting disassembly by distinguishing actual code from nonsense produced by disassembling unrelated data. Alternatively, you can figure out the actual executable parts of the file and disassemble just that.

| improve this answer | |
2

The -b switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The -D switch is also present in your question and this one means that objdump will treat the content of all sections as instructions even if it did take the header/file type into account.

If you onlt specify -D then it will treat all sections as instructions but it will print the section name before its data, so you can tell where it comes from.

That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is not less useful before it is unpacked. Unless of course the packing technique itself is of interest.

| improve this answer | |
  • I examined a windows executable with these two different commands. The difference of the size was huge. The objdump -b binary gives a 2.6 GB output and the other 4.7 MB. Why is that? – 0sunday Apr 19 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.