When using objdump I see the following disassembled code:
8049436: 89 04 24 mov DWORD PTR [esp],eax 8049439: e8 52 f7 ff ff call 8048b90 <gtk_entry_get_text@plt> 804943e: 89 44 24 24 mov DWORD PTR [esp+0x24],eax 8049442: eb 01 jmp 8049445 <gtk_grid_new@plt+0x6c5> 8049444: 1d c7 04 24 0b sbb eax,0xb2404c7 8049449: 00 00 add BYTE PTR [eax],al 804944b: 00 e8 add al,ch 804944d: 0f f7 ff maskmovq mm7,mm7 8049450: ff eb jmp <internal disassembler error>
This is using an obfuscation technique to make the disassembling harder. When I check in gdb I see the real code at 0x8049445:
(gdb) > x/10i 0x8049445 0x8049445: mov DWORD PTR [esp],0xb 0x804944c: call 0x8048b60 <raise@plt> 0x8049451: jmp 0x8049454 0x8049453: sbb eax,0xfff8a7e8
Now, my question is: is it possible to tell objdump that the byte at 0x8049444 can be ignored for the purpose of disassembly? One obvious way is to actually patch the file, but is there another way?
And if not with objdump, are there other tools that can do that? Though I'd rather stay with the basic tools included with Linux so as to familiarize myself with those better.