2

I've wrote a simple program to print something on the screen as below:

ebra@him:/tmp/tuts$ cat sample.c 
#include <stdio.h>

int main()
{
    puts("Sample!");
}

ebra@him:/tmp/tuts$ gcc sample.c -o sample
ebra@him:/tmp/tuts$ 
 
ebra@him:/tmp/tuts$ ./sample 
Sample!

And then I disassmbled the executable to see what is going on under the hood:

ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep "<main>:" -A 10
0000000000001149 <main>:
    1149:   f3 0f 1e fa             endbr64 
    114d:   55                      push   rbp
    114e:   48 89 e5                mov    rbp,rsp
    1151:   48 8d 3d ac 0e 00 00    lea    rdi,[rip+0xeac]        # 2004 <_IO_stdin_used+0x4>
    1158:   e8 f3 fe ff ff          call   1050 <puts@plt>
    115d:   b8 00 00 00 00          mov    eax,0x0
    1162:   5d                      pop    rbp
    1163:   c3                      ret    
    1164:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]
    116b:   00 00 00 

As you see above, right before calling puts function, we have lea rdi,[rip+0xeac]. I assume that [rip+0xeac] is the address of the hardcoded text (i.e. "Sample!").

Since rip is equal to 0x1151 while exucuting the mov line, the value of [rip + 0xeac] will be 0x1151 + 0xeac = 0x1ffd.

But I can't find this address in the disassembled program:

ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep -i 1ffd
ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep -i "Sample!"
ebra@him:/tmp/tuts$

Why?

1 Answer 1

4

to search String you cant be using disassemble-all

look at the bytes in both commands if you disassemble how can you find the string

objdump -s sample.exe |grep -i sample
sample.exe:     file format pei-i386
 404040 00000000 53616d70 6c652100 20634000  ....Sample!. c@.

objdump -M intel --disassemble-all sample.exe  --start-address=0x404044 --stop-address=0x40404f

sample.exe:     file format pei-i386


Disassembly of section .rdata:

00404044 <.rdata>:
  404044:       53                      push   ebx
  404045:       61                      popa
  404046:       6d                      ins    DWORD PTR es:[edi],dx
  404047:       70 6c                   jo     4040b5 <.rdata+0x45>
  404049:       65 21 00                and    DWORD PTR gs:[eax],eax

0040404c <_GS_ExceptionPointers>:
  40404c:       20 63 40                and    BYTE PTR [ebx+0x40],ah
2
  • Why does objdump tries to disassemble the .rdata section?! As far as I know, this section contains data/variables only. Am I wrong? Oct 17, 2020 at 8:38
  • 3
    :\>objdump --help |grep -i "disassemble-all" -D, --disassemble-all Display assembler contents of all sections
    – blabb
    Oct 17, 2020 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.